my nix configs
Harald Hoyer
a3e0de6d04
In recent runs the orchestrator skipped @pm and edited TODO/ files
itself, despite the workflow.md anti-pattern warning. Root cause: the
workflow doc literally taught the orchestrator the path layout
(`./TODO/<ID>.md`), making self-help a discoverable shortcut.
Fix: remove the recipe. The orchestrator now never constructs or reads
any per-issue TODO path. All TODO operations go through @pm dispatches;
@pm returns the absolute file path of every issue it touches, and the
orchestrator captures and reuses those paths downstream.
- Phase 1 loses the TODO-existence and depends-on checks (former steps
3 and 9 of the recent edit) — Phase 1 is now git/worktree-only.
- Phase 2 expands @pm's existing dispatch into a `Validate run
prerequisites` operation that returns either {ok: true,
issue_file_path, issue: {...}} or {ok: false, error_code, message}
with error_code in {tracker_missing, issue_not_found,
dependency_unmet, dependency_missing}. depends-on enforcement moves
here.
- Phase 7 split_needed exit, Phase 9 TODO Update, Phase 9 Commit TODO
Changes, and Failure Handler all reference @pm-returned paths or use
`git add ./TODO/` blanketly (safe because Phase 1 verified clean tree
and only @pm writes there during a run).
- pm.md gains a path-return rule: every read returns issue_file_path,
every write returns the modified paths. Run-Prerequisite Output
format documented with all four error codes.
- ADR-22 captures the rationale; routing matrix updates Phase 1/2 rows;
pipeline diagram labels updated.
The fix is discoverability-only — no permission deny on TODO/, per
explicit user direction. The schema lives in agents/pm.md, which the
orchestrator does not load.
Refs: config/opencode/workflow-design.md ADR-22
|
||
|---|---|---|
| .secrets | ||
| config | ||
| homes | ||
| lib | ||
| modules | ||
| overlays | ||
| packages | ||
| systems | ||
| .gitattributes | ||
| .gitignore | ||
| .sops.yaml | ||
| CLAUDE.md | ||
| flake.lock | ||
| flake.nix | ||
| README.md | ||
NixOS Configuration
A modular NixOS configuration setup for multiple systems.
Project Structure
modules/: Reusable NixOS/Darwin modulescommon.nix: Common module imports and definitionsnixos/: NixOS-specific moduleshome/: Home Manager integration for NixOSnix/: Nix package manager configurationnix-ld/: Dynamic linking supportnetwork/: Network configuration modulesresolved/: DNS resolution configuration
security/: Security-related modulesssh-host-keys/: SSH host key management
services/: Service configuration modulesbase/: Basic system configurationgui/: Graphical interface setuphomeprinter/: Home printer supportpodman/: Container runtimesecureboot/: Secure boot configuration
sgx/: Intel SGX supportaesmd_dcap/: SGX AESMD DCAP servicepccs/: SGX Provisioning Certificate Caching Service
system/: System configuration modulesauto-upgrade/: Automatic system upgradeslimits/: System resource limitszram/: ZRAM swap configuration
tools/: Common tools configurationdirenv/: Direnv integrationgit/: Git configuration
user/: User account configurationvirtualization/: Virtualization support
home/: Home Manager modulescli-apps/: Command-line applicationsgui/: GUI application configurationtools/: User tools configurationuser/: User preferences
darwin/: Darwin-specific moduleshome/,nix/,security/, etc.
systems/: Individual system configurationsx86_64-linux/: Linux systems on x86_64aarch64-linux/: Linux systems on ARMx86_64-darwin/: macOS systems on x86_64aarch64-darwin/: macOS systems on ARM
homes/: Home Manager configurations for each user/systemlib/: Helper functions and utilitiesoverlays/: Nixpkgs overlayspackages/: Custom packages
Using the Configurations
Install a system via nixos-anywhere
$ nix run github:numtide/nixos-anywhere -- \
--flake 'git+https://git.hoyer.xyz/harald/nixcfg'.#hostname \
root@hostname --no-reboot --tty -i $HOME/.ssh/id_ed25519
... enter disk password
$ ssh -t root@hostname systemd-cryptenroll /dev/luksdev --wipe-slot=tpm2 --tpm2-device=auto --tpm2-pcrs=1,15
Update NixOS system
$ nixos-rebuild --use-remote-sudo -L --show-trace --refresh --flake git+https://git.hoyer.xyz/harald/nixcfg boot
Update macOS system
$ darwin-rebuild -L --show-trace --refresh --flake git+https://git.hoyer.xyz/harald/nixcfg switch
Update home-manager configuration
$ nix --refresh run 'git+https://git.hoyer.xyz/harald/nixcfg' -- \
switch -b backup --flake 'git+https://git.hoyer.xyz/harald/nixcfg'