proper repo

README.md

@@ -0,0 +1,84 @@
+# NixOS Configuration
+
+Personal NixOS configuration using the [den](https://github.com/vic/den) framework (dendritic pattern).
+
+## Hosts
+
+| Hostname   | Profile              | GPU    |
+|------------|----------------------|--------|
+| `desktop`  | Gaming + development | Nvidia |
+| `notebook` | Portable development | Intel  |
+
+## Prerequisites
+
+- [just](https://github.com/casey/just): `nix shell nixpkgs#just`
+- [nvd](https://github.com/khumba/nvd) for `just diff`: `nix shell nixpkgs#nvd`
+
+## Usage
+
+```bash
+# Rebuild and switch (uses current hostname automatically)
+just switch
+
+# Target a specific host
+just switch desktop
+just switch notebook
+
+# Build only, without switching
+just build
+
+# Test (applies temporarily, reverts on next boot)
+just test
+
+# Update all inputs
+just update
+
+# Update a single input
+just update-input nixpkgs
+
+# Run garbage collection
+just gc
+
+# See what changed before switching
+just diff
+```
+
+## Secrets (SOPS + age)
+
+Secrets are stored encrypted in `secrets/secrets.yaml` and decrypted at boot by [sops-nix](https://github.com/Mic92/sops-nix).
+
+### First-time setup on a new machine
+
+1. Generate an age key:
+   ```bash
+   mkdir -p /etc/sops/age
+   age-keygen -o /etc/sops/age/keys.txt
+   ```
+
+2. Add the new public key to `.sops.yaml` under `keys:`.
+
+3. Re-encrypt secrets for all keys:
+   ```bash
+   sops updatekeys secrets/secrets.yaml
+   ```
+
+### Adding a new secret
+
+1. Edit the secrets file: `just secrets`
+2. Declare it in `modules/secrets.nix` under `sops.secrets`.
+
+### Rotating the age key
+
+1. Generate a new key (step 1 above).
+2. Update `.sops.yaml` with the new public key.
+3. Run `sops updatekeys secrets/secrets.yaml` to re-encrypt.
+
+## Identity
+
+All user identity (name, email, SSH key) lives in `modules/identity.nix`. Override the defaults there or in a profile-specific module when creating a new user profile.
+
+## Adding a new host
+
+1. Run `nixos-generate-config` on the target machine and copy the output to `modules/_hardware/<hostname>-hardware.nix`.
+2. Add the host in `modules/den.nix` under `den.hosts`.
+3. Define or reuse an aspect for the host profile.