106 lines
4.3 KiB
Markdown
106 lines
4.3 KiB
Markdown
# garden
|
||
|
||
Hosts in this repo are named after plants and flowers.
|
||
|
||
## hosts
|
||
|
||
### poppy *(active)*
|
||
- **role:** MacBook Air M1, personal/work machine
|
||
- **system:** nix-darwin, aarch64-darwin
|
||
- **location:** daily driver
|
||
|
||
### muscari *(planned migration)*
|
||
- **role:** linux server, k3s cluster
|
||
- **system:** NixOS, x86_64-linux
|
||
- **location:** iscg infra
|
||
|
||
### rosemary *(planned)*
|
||
- **role:** backup VM
|
||
- **system:** NixOS, x86_64-linux
|
||
|
||
## structure
|
||
|
||
- `flake.nix` — entry point, dispatches `mkNixos` and `mkDarwin` per host
|
||
- `hosts/<name>/default.nix` — per-host config
|
||
- `hosts/common/default.nix` — shared NixOS config
|
||
- `hosts/common-darwin/default.nix` — shared darwin config
|
||
- `home/default.nix` — shared home-manager config for user `michaotic` (plan to migrate to `mikl` later)
|
||
- `secrets/` — sops-encrypted secrets per host
|
||
|
||
## documentation
|
||
|
||
notes are split by topic under `docs/`:
|
||
|
||
- `docs/structure.md` — high-level overview, where things go
|
||
- `docs/poppy.md` — MacBook specific (homebrew, system defaults)
|
||
- `docs/muscari.md` — server + k3s specifics
|
||
- `docs/shell.md` — zsh, pure prompt, plugins
|
||
- `docs/terminal.md` — kitty + catppuccin theme
|
||
- `docs/cheatsheet.md` — quick commands reference
|
||
|
||
when adding a new host: copy `docs/structure.md` template, document hostname, role, packages unique to it.
|
||
|
||
## migrations
|
||
|
||
- `nix-config-legacy/` — previous muscari-only config (preserved for reference)
|
||
|
||
## future plans
|
||
|
||
### username migration
|
||
|
||
currently using `michaotic` as username (historical). plan to migrate to `mikl` across all hosts for consistency.
|
||
|
||
**why not now:**
|
||
- macOS: changing username requires careful handling of home folder, keychain, permissions
|
||
- linux: easier, but better to do in one coordinated change
|
||
|
||
**when:** after setting up proper backups and testing migration procedure
|
||
|
||
### rosemary setup
|
||
|
||
currently `flake.nix` has `rosemary` commented out. need to:
|
||
- add disk config (likely similar to muscari)
|
||
- add users.users.michaotic.openssh.authorizedKeys
|
||
- test `nix flake check`
|
||
|
||
### documentation improvements
|
||
|
||
- [ ] create `docs/bootstrap.md` — manual setup guide for fresh device without nix (emergency fallback)
|
||
- list all CLI tools and how to install via brew/pnpm
|
||
- list all system defaults that need manual configuration
|
||
- explain which tools are nix-managed vs brew-managed
|
||
- [ ] create `docs/adding-host.md` — checklist for adding a new host
|
||
- [ ] create `docs/secrets.md` — sops-nix setup when we get there
|
||
- [ ] add migration notes to `docs/structure.md` as we learn patterns
|
||
- [ ] screenshots/notes for things that aren't obvious (e.g. dock layout)
|
||
|
||
### tech debt
|
||
|
||
- [ ] **git config** — разобраться с конфликтом `~/.gitconfig` (локальный) vs `~/.config/git/config` (home-manager)
|
||
- перенести osxkeychain credential helper, lfs в home-manager
|
||
- унифицировать user.name/email (michaotic vs mikl)
|
||
- добавить `core.pager = delta` явно
|
||
|
||
- [ ] **git origins / remotes** — разобраться как декларативно описывать несколько git origins для произвольного репозитория
|
||
- использовать для pass-store (github + git.sol.moe + forgejo)
|
||
- сейчас делаем руками
|
||
- возможно через `home.file` + `.git/config` в Nix
|
||
- решить когда будет актуально
|
||
|
||
- [ ] **pass-store sync** — настроить `~/.password-store` с remotes (forgejo primary, github/git.sol.moe backup)
|
||
- сначала создать репы на всех 3 хостах
|
||
- потом настроить через `pass git remote add`
|
||
- алиасы в zsh для каждого origin
|
||
|
||
### FIDO2 / Ledger Security Key
|
||
|
||
Ledger поддерживает FIDO2 через `app-security-key` (open source). SSH-ключ создан
|
||
на токене (ed25519-sk), работает локально (sign/verify). Задачи — см. `docs/ssh.md`.
|
||
|
||
### sops-nix для секретов
|
||
|
||
`flake.nix` уже содержит `sops-nix` в inputs. Нужно:
|
||
- создать age ключ (`age-keygen -o ~/.config/sops/age/keys.txt`)
|
||
- настроить `secrets/secrets.yaml` с SOPS config
|
||
- сконфигурировать `SOPS_AGE_KEY_FILE` (уже в `home/sessionVariables`)
|
||
- переместить `OPENROUTER_API_KEY` из plain text в encrypted
|