# NixOS Configuration

Personal NixOS configuration using the [den](https://github.com/vic/den) framework (dendritic pattern).

## Hosts

| Hostname   | Profile              | GPU    |
|------------|----------------------|--------|
| `desktop`  | Gaming + development | Nvidia |
| `notebook` | Portable development | Intel  |

## Prerequisites

- [just](https://github.com/casey/just): `nix shell nixpkgs#just`
- [nvd](https://github.com/khumba/nvd) for `just diff`: `nix shell nixpkgs#nvd`

## Usage

```bash
# Rebuild and switch (uses current hostname automatically)
just switch

# Target a specific host
just switch desktop
just switch notebook

# Build only, without switching
just build

# Test (applies temporarily, reverts on next boot)
just test

# Update all inputs
just update

# Update a single input
just update-input nixpkgs

# Run garbage collection
just gc

# See what changed before switching
just diff
```

## Secrets (SOPS + age)

Secrets are stored encrypted in `secrets/secrets.yaml` and decrypted at boot by [sops-nix](https://github.com/Mic92/sops-nix).

### First-time setup on a new machine

1. Generate an age key:
   ```bash
   mkdir -p /etc/sops/age
   age-keygen -o /etc/sops/age/keys.txt
   ```

2. Add the new public key to `.sops.yaml` under `keys:`.

3. Re-encrypt secrets for all keys:
   ```bash
   sops updatekeys secrets/secrets.yaml
   ```

### Adding a new secret

1. Edit the secrets file: `just secrets`
2. Declare it in `modules/secrets.nix` under `sops.secrets`.

### Rotating the age key

1. Generate a new key (step 1 above).
2. Update `.sops.yaml` with the new public key.
3. Run `sops updatekeys secrets/secrets.yaml` to re-encrypt.

## Identity

All user identity (name, email, SSH key) lives in `modules/identity.nix`. Override the defaults there or in a profile-specific module when creating a new user profile.

## Adding a new host

1. Run `nixos-generate-config` on the target machine and copy the output to `modules/_hardware/<hostname>-hardware.nix`.
2. Add the host in `modules/den.nix` under `den.hosts`.
3. Define or reuse an aspect for the host profile.