- common/default.nix: add mikl to wheel + security.sudo.wheelNeedsPassword=false.
Without this, root is unreachable on a fresh NixOS-yc image (no root password,
no rescue channel) — nixos-rebuild switch is impossible. Mirrors the
NOPASSWD:ALL that old YC boxes got via cloud-config user-data.
- home/server.nix: programs.git.extraConfig -> .settings, programs.git.delta
-> programs.delta with enableGitIntegration=true (deprecated warnings).
- image.nix: boot.loader.grub.timeout -> boot.loader.timeout (renamed option).
- Rename muscari -> heather (YC VM). rosemary reserved for future EU server.
- Add hosts/heather/image.nix: YC guest profile + qcow2 build target based on
nixos/lib/make-disk-image.nix (the nixpkgs-standard cloud image builder).
partitionTableType=legacy (MBR + single ext4 root, label nixos), GRUB in MBR
on /dev/vda, virtio drivers, console=ttyS0, cloud-init (Ec2 datasource) so
poppy ssh key auto-lands from YC metadata, growPartition.
- Drop disko flake input + disk-config.nix (was only for nixos-anywhere runtime
install; replaced by make-disk-image build-time approach, no kexec).
- Add home/server.nix: minimal headless home for NixOS hosts (no ollama/
texliveFull/kitty/syncthing/pass). flake mkNixos uses it instead of full ./home.
- k3s.nix: drop dead firewall block (firewall off in image.nix -> trustedInterfaces
was a no-op). Cilium manages pod networking via BPF.
- image.baseName=heather, configurationLimit=1, remove virtio dups (qemu-guest
profile already provides most).
- Fix sha256 pin on forgejo mikl.keys (was stale, would break fetchurl).
- home/zsh.nix: source yandex-cloud yc completion.
- nodejs from nixpkgs is read-only, breaks pi-coding-agent internal npm install
- Use homebrew node (writable) for proper npm/pnpm global installs
- Remove pi-node hardcoded path hack from PATH
- Replace hardcoded PATH with home.sessionPath for proper ordering
- Use ${config.home.homeDirectory} and ${config.home.username} for portability
- Add PNPM_HOME for pnpm global packages
- Remove hardcoded node version path (install pi via pnpm i -g)
