# NixOS Configuration

Personal NixOS configuration using the [den](https://github.com/vic/den) framework (dendritic pattern).

## Hosts

| Hostname   | Profile              | GPU    |
|------------|----------------------|--------|
| `desktop`  | Gaming + development | Nvidia |
| `notebook` | Portable development | Intel  |
| `work`     | Portable development | AMD + Nvidia (PRIME) |

## Prerequisites

- [just](https://github.com/casey/just): `nix shell nixpkgs#just`
- [nvd](https://github.com/khumba/nvd) for `just diff`: `nix shell nixpkgs#nvd`

## Usage

```bash
# Rebuild and switch (uses current hostname automatically)
just switch

# Target a specific host
just switch desktop
just switch notebook

# Build only, without switching
just build

# Test (applies temporarily, reverts on next boot)
just test

# Update all inputs
just update

# Update a single input
just update-input nixpkgs

# Run garbage collection
just gc

# See what changed before switching
just diff
```

## Installing on a new machine (notebook)

Only the `notebook` host supports automated installation via the installer ISO.
No hardware-specific preparation is needed beforehand — the installer detects the
hardware automatically using `nixos-generate-config`.

### 1. Build and flash the ISO

The ISO embeds the flake at build time, so **all changes must be committed first**.

```bash
# Commit any pending changes — the ISO only includes git-tracked files
git add -A && git commit -m "pre-install snapshot"

just iso
sudo dd if=result/iso/*.iso of=/dev/sdX bs=4M status=progress && sync
```

### 2. Boot and install

Boot the ISO on the target machine. The installer logs in as root automatically.

**If you need Wi-Fi**, the script will prompt you to connect via `nmtui` before proceeding.

Run the installer:
```bash
nixos-install-host
```

The script will:
1. Prompt to set up network (Wi-Fi via `nmtui` if needed)
2. Ask which host to install (`notebook`)
3. **Auto-detect hardware** with `nixos-generate-config` and inject the result into the flake
4. Show available disks and confirm the target
5. Ask for the age key (`keys.txt`) — copy it to a USB or provide the path manually
6. Partition the disk with LUKS + btrfs via disko (prompts for LUKS passphrase)
7. Run `nixos-install`
8. Copy the flake (with detected hardware config) to `~/repos/nixos` on the new system

### 3. Age key

The age key used to encrypt `secrets/secrets.yaml` must be available during installation.
Bring it on a USB drive — the installer will find it automatically at `/run/media/*/keys.txt`.

### 4. After the first boot

Commit the auto-detected hardware config so future ISO builds include it:

```bash
cd ~/repos/nixos
git add modules/_hardware/notebook-hardware.nix
git commit -m "add notebook hardware config"
git push
```

> **Note:** GRUB will ask for the LUKS passphrase once during boot, and the initrd will ask
> again to mount the root filesystem. This is expected behavior with `enableCryptodisk`.

## Secrets (SOPS + age)

Secrets are stored encrypted in `secrets/secrets.yaml` and decrypted at boot by [sops-nix](https://github.com/Mic92/sops-nix).

### First-time setup on a new machine

1. Generate an age key:
   ```bash
   mkdir -p /etc/sops/age
   age-keygen -o /etc/sops/age/keys.txt
   ```

2. Add the new public key to `.sops.yaml` under `keys:`.

3. Re-encrypt secrets for all keys:
   ```bash
   sops updatekeys secrets/secrets.yaml
   ```

### Adding a new secret

1. Edit the secrets file: `just secrets`
2. Declare it in `modules/secrets.nix` under `sops.secrets`.

### Rotating the age key

1. Generate a new key (step 1 above).
2. Update `.sops.yaml` with the new public key.
3. Run `sops updatekeys secrets/secrets.yaml` to re-encrypt.

## Identity

All user identity (name, email, SSH key) lives in `modules/identity.nix`. Override the defaults there or in a profile-specific module when creating a new user profile.

## Adding a new host

1. Run `nixos-generate-config` on the target machine and copy the output to `modules/_hardware/<hostname>-hardware.nix`.
2. Add the host in `modules/den.nix` under `den.hosts`.
3. Define or reuse an aspect for the host profile.