my nix configs
Harald Hoyer
91ba5bd272
A workflow run on a Bevy weaving feature exposed two compounding
failures:
1. @test wrote 8 structural-only Rust tests that never invoked
weave_enemies or trigger_weaving. Every test passed against the
stub-first @make pre-pass because none of them called the
stubbed symbols, so todo!() never fired. The body-pass committed
code that "passed" the suite and silently broke trigger_weaving
in special stages.
2. @check found the trigger_weaving regression at Phase 8 (final
review) and the orchestrator decided to "fix them directly"
rather than dispatching @make — taking the license offered by
the existing review-loop wording.
Test-quality fixes:
- Phase 3 Test Design now requires each behavior to be expressed as
an action + observable outcome. Structural facts ("enum has 3
variants", "struct has these fields") are explicitly disqualified.
- Phase 6 stub-first flow gains a mandatory Panic-coverage check:
after @test returns, the orchestrator re-runs the test command and
rejects the output unless every test panics on todo!() (i.e. every
test exercises at least one stubbed symbol). Any passing test is
structural-only and routes back to @test.
- Phase 6 decision table gets a "Stub-first run: tests pass with zero
todo!() panics" row covering the same case.
- @test's Test Philosophy gains an explicit Do-NOT-write list of
structural-only patterns (variant_count, type ascriptions,
Box::new(my_fn), struct-literal-only flows, all-pass-on-stubs)
plus a positive rule: every test must call a function and assert
on observable outcome, or return NOT_TESTABLE rather than pad the
suite.
Orchestrator boundary fix:
- Phase 8 review loop replaces "fix them directly (no need to
re-dispatch @make for small fixes)" with the principle "the
orchestrator does not write production code; @make does". BLOCK,
behavioral, correctness, and test-quality findings round-trip
through @make. Only AST-preserving cosmetic edits (typos in
comments, trailing newlines) may be applied directly. Compiler-
detected issues (unused imports, dead code) go through @make.
|
||
|---|---|---|
| .secrets | ||
| config | ||
| homes | ||
| lib | ||
| modules | ||
| overlays | ||
| packages | ||
| systems | ||
| .gitattributes | ||
| .gitignore | ||
| .sops.yaml | ||
| CLAUDE.md | ||
| flake.lock | ||
| flake.nix | ||
| README.md | ||
NixOS Configuration
A modular NixOS configuration setup for multiple systems.
Project Structure
modules/: Reusable NixOS/Darwin modulescommon.nix: Common module imports and definitionsnixos/: NixOS-specific moduleshome/: Home Manager integration for NixOSnix/: Nix package manager configurationnix-ld/: Dynamic linking supportnetwork/: Network configuration modulesresolved/: DNS resolution configuration
security/: Security-related modulesssh-host-keys/: SSH host key management
services/: Service configuration modulesbase/: Basic system configurationgui/: Graphical interface setuphomeprinter/: Home printer supportpodman/: Container runtimesecureboot/: Secure boot configuration
sgx/: Intel SGX supportaesmd_dcap/: SGX AESMD DCAP servicepccs/: SGX Provisioning Certificate Caching Service
system/: System configuration modulesauto-upgrade/: Automatic system upgradeslimits/: System resource limitszram/: ZRAM swap configuration
tools/: Common tools configurationdirenv/: Direnv integrationgit/: Git configuration
user/: User account configurationvirtualization/: Virtualization support
home/: Home Manager modulescli-apps/: Command-line applicationsgui/: GUI application configurationtools/: User tools configurationuser/: User preferences
darwin/: Darwin-specific moduleshome/,nix/,security/, etc.
systems/: Individual system configurationsx86_64-linux/: Linux systems on x86_64aarch64-linux/: Linux systems on ARMx86_64-darwin/: macOS systems on x86_64aarch64-darwin/: macOS systems on ARM
homes/: Home Manager configurations for each user/systemlib/: Helper functions and utilitiesoverlays/: Nixpkgs overlayspackages/: Custom packages
Using the Configurations
Install a system via nixos-anywhere
$ nix run github:numtide/nixos-anywhere -- \
--flake 'git+https://git.hoyer.xyz/harald/nixcfg'.#hostname \
root@hostname --no-reboot --tty -i $HOME/.ssh/id_ed25519
... enter disk password
$ ssh -t root@hostname systemd-cryptenroll /dev/luksdev --wipe-slot=tpm2 --tpm2-device=auto --tpm2-pcrs=1,15
Update NixOS system
$ nixos-rebuild --use-remote-sudo -L --show-trace --refresh --flake git+https://git.hoyer.xyz/harald/nixcfg boot
Update macOS system
$ darwin-rebuild -L --show-trace --refresh --flake git+https://git.hoyer.xyz/harald/nixcfg switch
Update home-manager configuration
$ nix --refresh run 'git+https://git.hoyer.xyz/harald/nixcfg' -- \
switch -b backup --flake 'git+https://git.hoyer.xyz/harald/nixcfg'