From 88c51399d08220a82d17031349654da86de2dfda Mon Sep 17 00:00:00 2001 From: DannyDannyDanny Date: Sun, 19 Apr 2026 15:19:59 +0200 Subject: [PATCH] =?UTF-8?q?refactor(nix):=20move=20flake=20to=20repo=20roo?= =?UTF-8?q?t=20=F0=9F=9A=9A?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit clan-cli silently ignores the `?dir=` URL parameter when resolving a flake source, so with the flake at nixos/flake.nix `clan machines update` fails with "flake.nix does not exist". Move the flake tree up so the repo root contains flake.nix, flake.lock, flake-modules/, lib/, modules/, sops/, and vars/. Host-specific NixOS modules stay in nixos/{hosts,home,fish.nix,neovim.nix,…}; flake-module paths updated accordingly. - dotfiles-rebuild flakeRef is now "${dotfilesDir}#" (was "${dotfilesDir}/nixos#"). - CLAUDE.md build commands + clan section updated. nixupdate fish alias updated. sunken-ship hostsfile comment updated. - Existing /etc/dotfiles checkouts on the servers will pick up the new layout on the next `dotfiles-rebuild` timer tick; the rebuild service was pre-updated via rsync so its flakeRef matches before the pull. Also includes 4b follow-through: zerotier identities are now live on both servers (sunken-ship=d553a2de33 controller, phantom-ship=6c048abbdc peer) and IPv6 ping across the ZT mesh works. --- CLAUDE.md | 23 +++++++++++-------- .../flake-modules => flake-modules}/clan.nix | 4 ++-- .../daniel-macbook-air.nix | 6 ++--- .../installer-iso.nix | 2 +- .../nixos-modules.nix | 0 .../server-install.nix | 4 ++-- .../flake-modules => flake-modules}/wsl.nix | 6 ++--- nixos/flake.lock => flake.lock | 0 nixos/flake.nix => flake.nix | 0 {nixos/lib => lib}/home-manager-user.nix | 0 .../modules => modules}/dotfiles-rebuild.nix | 4 ++-- nixos/fish.nix | 2 +- nixos/hosts/sunken-ship.nix | 2 +- .../machines/phantom-ship/key.json | 0 .../machines/sunken-ship/key.json | 0 .../secrets/phantom-ship-age.key/secret | 0 .../secrets/phantom-ship-age.key/users/danny | 0 .../secrets/sunken-ship-age.key/secret | 0 .../secrets/sunken-ship-age.key/users/danny | 0 {nixos/sops => sops}/users/danny/key.json | 0 .../machines/phantom-ship | 0 .../zerotier/zerotier-identity-secret/secret | 0 .../zerotier-identity-secret/users/danny | 0 .../phantom-ship/zerotier/zerotier-ip/value | 0 .../machines/sunken-ship | 0 .../zerotier/zerotier-identity-secret/secret | 0 .../zerotier-identity-secret/users/danny | 0 .../sunken-ship/zerotier/zerotier-ip/value | 0 .../zerotier/zerotier-network-id/value | 0 .../zerotier-identity-secret/secret | 0 .../zerotier-identity-secret/users/danny | 0 .../zerotier-controller/zerotier-ip/value | 0 .../zerotier-network-id/value | 0 33 files changed, 29 insertions(+), 24 deletions(-) rename {nixos/flake-modules => flake-modules}/clan.nix (97%) rename {nixos/flake-modules => flake-modules}/daniel-macbook-air.nix (82%) rename {nixos/flake-modules => flake-modules}/installer-iso.nix (89%) rename {nixos/flake-modules => flake-modules}/nixos-modules.nix (100%) rename {nixos/flake-modules => flake-modules}/server-install.nix (78%) rename {nixos/flake-modules => flake-modules}/wsl.nix (80%) rename nixos/flake.lock => flake.lock (100%) rename nixos/flake.nix => flake.nix (100%) rename {nixos/lib => lib}/home-manager-user.nix (100%) rename {nixos/modules => modules}/dotfiles-rebuild.nix (90%) rename {nixos/sops => sops}/machines/phantom-ship/key.json (100%) rename {nixos/sops => sops}/machines/sunken-ship/key.json (100%) rename {nixos/sops => sops}/secrets/phantom-ship-age.key/secret (100%) rename {nixos/sops => sops}/secrets/phantom-ship-age.key/users/danny (100%) rename {nixos/sops => sops}/secrets/sunken-ship-age.key/secret (100%) rename {nixos/sops => sops}/secrets/sunken-ship-age.key/users/danny (100%) rename {nixos/sops => sops}/users/danny/key.json (100%) rename {nixos/vars => vars}/per-machine/phantom-ship/zerotier/zerotier-identity-secret/machines/phantom-ship (100%) rename {nixos/vars => vars}/per-machine/phantom-ship/zerotier/zerotier-identity-secret/secret (100%) rename {nixos/vars => vars}/per-machine/phantom-ship/zerotier/zerotier-identity-secret/users/danny (100%) rename {nixos/vars => vars}/per-machine/phantom-ship/zerotier/zerotier-ip/value (100%) rename {nixos/vars => vars}/per-machine/sunken-ship/zerotier/zerotier-identity-secret/machines/sunken-ship (100%) rename {nixos/vars => vars}/per-machine/sunken-ship/zerotier/zerotier-identity-secret/secret (100%) rename {nixos/vars => vars}/per-machine/sunken-ship/zerotier/zerotier-identity-secret/users/danny (100%) rename {nixos/vars => vars}/per-machine/sunken-ship/zerotier/zerotier-ip/value (100%) rename {nixos/vars => vars}/per-machine/sunken-ship/zerotier/zerotier-network-id/value (100%) rename {nixos/vars => vars}/shared/zerotier-controller/zerotier-identity-secret/secret (100%) rename {nixos/vars => vars}/shared/zerotier-controller/zerotier-identity-secret/users/danny (100%) rename {nixos/vars => vars}/shared/zerotier-controller/zerotier-ip/value (100%) rename {nixos/vars => vars}/shared/zerotier-controller/zerotier-network-id/value (100%) diff --git a/CLAUDE.md b/CLAUDE.md index 43ff508..bb5dddb 100644 --- a/CLAUDE.md +++ b/CLAUDE.md @@ -2,8 +2,10 @@ ## Build commands +The flake lives at the repo root (`~/dotfiles/flake.nix`) — clan-cli doesn't handle flakes in subdirs. + ```bash -# macOS (from ~/dotfiles/nixos) +# macOS (from ~/dotfiles) darwin-rebuild switch --flake . # NixOS servers (SSH from mac, or on server) @@ -11,13 +13,17 @@ sudo nixos-rebuild switch --flake .#sunken-ship sudo nixos-rebuild switch --flake .#phantom-ship # WSL -sudo nixos-rebuild switch --flake ~/dotfiles/nixos#wsl +sudo nixos-rebuild switch --flake ~/dotfiles#wsl # Update flake + rebuild (fish alias: nixupdate) -cd ~/dotfiles/nixos && sudo nix flake update && sudo darwin-rebuild switch --flake ~/dotfiles/nixos#Daniel-Macbook-Air +cd ~/dotfiles && sudo nix flake update && sudo darwin-rebuild switch --flake ~/dotfiles#Daniel-Macbook-Air # Installer ISO (Linux only, cannot build on macOS) -cd ~/dotfiles/nixos && nix build .#installer-iso +cd ~/dotfiles && nix build .#installer-iso + +# Clan push update (from mac; builds on target so aarch64-darwin → x86_64-linux works) +nix run git+https://git.clan.lol/clan/clan-core#clan-cli -- \ + machines update sunken-ship --flake ~/dotfiles ``` ## Rebuild protocol @@ -47,7 +53,7 @@ cd ~/dotfiles/nixos && nix build .#installer-iso ## Server (sunken-ship) - SSH: `ssh -i ~/.ssh/id_ed25519_sunken_ship danny@sunken-ship` -- Remote rebuild: `ssh ... 'cd /etc/dotfiles/nixos && sudo nixos-rebuild switch --flake .#sunken-ship'` +- Remote rebuild: `ssh ... 'cd /etc/dotfiles && sudo nixos-rebuild switch --flake .#sunken-ship'` - Auto-rebuild timer: `dotfiles-rebuild` — every 15 min. Check with `systemctl is-active dotfiles-rebuild.timer`. - WiFi connected; stays reachable when ethernet is unplugged. - Services: UxPlay (AirPlay receiver on Scarlett Solo) @@ -55,7 +61,7 @@ cd ~/dotfiles/nixos && nix build .#installer-iso ## Server (phantom-ship) - SSH: `ssh danny@phantom-ship` -- Remote rebuild: `ssh ... 'cd /etc/dotfiles/nixos && sudo nixos-rebuild switch --flake .#phantom-ship'` +- Remote rebuild: `ssh ... 'cd /etc/dotfiles && sudo nixos-rebuild switch --flake .#phantom-ship'` - Auto-rebuild timer: same pattern as sunken-ship. - Ethernet only (no WiFi). @@ -72,11 +78,10 @@ Terminal colors follow **System Settings → Appearance**: `programs.alacritty` **CLI invocation:** clan-cli is not installed globally. Run ad-hoc via: ```bash -nix run git+https://git.clan.lol/clan/clan-core#clan-cli -- machines list \ - --flake 'path:/Users/danny/dotfiles/nixos' +nix run git+https://git.clan.lol/clan/clan-core#clan-cli -- machines list --flake ~/dotfiles ``` -**Flake path quirk:** `--flake .` and `--flake git+…` both fail from a git worktree when the flake lives in a subdir (`nixos/`). Use `--flake 'path:…/nixos'` explicitly. May not be needed from the main checkout — retest. +Flake lives at the repo root (not `nixos/`) — clan-cli silently ignores `?dir=` so a subdir flake breaks `clan machines update`. **`enableRecommendedDefaults = false`:** we opted out fleet-wide because clan's defaults flip to `systemd-networkd` + `systemd-resolved` + `boot.initrd.systemd`, which breaks dnsmasq (NAT DNS on phantom-ship) and navidrome's resolv.conf bind-mount on sunken-ship. Revisit per-service in a later pass — the defaults also include handy extras (tcpdump, htop, curl, jq, nixos-facter). Option defined in `nixosModules/clanCore/defaults.nix` + `nixosModules/clanCore/networking.nix` inside the `clan-core` flake. diff --git a/nixos/flake-modules/clan.nix b/flake-modules/clan.nix similarity index 97% rename from nixos/flake-modules/clan.nix rename to flake-modules/clan.nix index 56defc6..3c6d5ba 100644 --- a/nixos/flake-modules/clan.nix +++ b/flake-modules/clan.nix @@ -47,7 +47,7 @@ in { clan.core.networking.targetHost = "danny@sunken-ship"; clan.core.networking.buildHost = "danny@sunken-ship"; } - ../hosts/sunken-ship.nix + ../nixos/hosts/sunken-ship.nix config.flake.nixosModules.dotfiles-rebuild inputs.home-manager.nixosModules.home-manager (hmModule { @@ -66,7 +66,7 @@ in { clan.core.networking.buildHost = "danny@phantom-ship"; } inputs.nix-openclaw.nixosModules.openclaw-gateway - ../hosts/phantom-ship.nix + ../nixos/hosts/phantom-ship.nix config.flake.nixosModules.dotfiles-rebuild inputs.home-manager.nixosModules.home-manager (hmModule { diff --git a/nixos/flake-modules/daniel-macbook-air.nix b/flake-modules/daniel-macbook-air.nix similarity index 82% rename from nixos/flake-modules/daniel-macbook-air.nix rename to flake-modules/daniel-macbook-air.nix index 4729175..8bd1874 100644 --- a/nixos/flake-modules/daniel-macbook-air.nix +++ b/flake-modules/daniel-macbook-air.nix @@ -7,15 +7,15 @@ }) ]; } - ../hosts/daniel-macbook-air.nix - ../fish.nix + ../nixos/hosts/daniel-macbook-air.nix + ../nixos/fish.nix inputs.home-manager.darwinModules.home-manager (import ../lib/home-manager-user.nix { lib = inputs.nixpkgs.lib; user = "danny"; homeDirectory = "/Users/danny"; - userImports = [ ../home/danny/home.nix ]; + userImports = [ ../nixos/home/danny/home.nix ]; }) ]; }; diff --git a/nixos/flake-modules/installer-iso.nix b/flake-modules/installer-iso.nix similarity index 89% rename from nixos/flake-modules/installer-iso.nix rename to flake-modules/installer-iso.nix index f2f7163..fc18929 100644 --- a/nixos/flake-modules/installer-iso.nix +++ b/flake-modules/installer-iso.nix @@ -3,7 +3,7 @@ # Optional: add ./installer-wifi.nix (gitignored) to modules for live WiFi. flake.nixosConfigurations.installer-iso = inputs.nixpkgs.lib.nixosSystem { system = "x86_64-linux"; - modules = [ ../installer-iso.nix ]; + modules = [ ../nixos/installer-iso.nix ]; }; flake.packages.x86_64-linux.installer-iso = diff --git a/nixos/flake-modules/nixos-modules.nix b/flake-modules/nixos-modules.nix similarity index 100% rename from nixos/flake-modules/nixos-modules.nix rename to flake-modules/nixos-modules.nix diff --git a/nixos/flake-modules/server-install.nix b/flake-modules/server-install.nix similarity index 78% rename from nixos/flake-modules/server-install.nix rename to flake-modules/server-install.nix index 1366ae9..e38d2c9 100644 --- a/nixos/flake-modules/server-install.nix +++ b/flake-modules/server-install.nix @@ -4,8 +4,8 @@ system = "x86_64-linux"; modules = [ inputs.disko.nixosModules.disko - ../disko-server.nix - ../hosts/server-install.nix + ../nixos/disko-server.nix + ../nixos/hosts/server-install.nix ]; }; } diff --git a/nixos/flake-modules/wsl.nix b/flake-modules/wsl.nix similarity index 80% rename from nixos/flake-modules/wsl.nix rename to flake-modules/wsl.nix index e9a491d..6cc2c44 100644 --- a/nixos/flake-modules/wsl.nix +++ b/flake-modules/wsl.nix @@ -4,15 +4,15 @@ modules = [ inputs.nixos-wsl.nixosModules.default inputs.vscode-server.nixosModules.default - ../hosts/wsl.nix - ../fish.nix + ../nixos/hosts/wsl.nix + ../nixos/fish.nix inputs.home-manager.nixosModules.home-manager (import ../lib/home-manager-user.nix { lib = inputs.nixpkgs.lib; user = "dth"; homeDirectory = "/home/dth"; - userImports = [ ../home/danny/home.nix ]; + userImports = [ ../nixos/home/danny/home.nix ]; }) ]; }; diff --git a/nixos/flake.lock b/flake.lock similarity index 100% rename from nixos/flake.lock rename to flake.lock diff --git a/nixos/flake.nix b/flake.nix similarity index 100% rename from nixos/flake.nix rename to flake.nix diff --git a/nixos/lib/home-manager-user.nix b/lib/home-manager-user.nix similarity index 100% rename from nixos/lib/home-manager-user.nix rename to lib/home-manager-user.nix diff --git a/nixos/modules/dotfiles-rebuild.nix b/modules/dotfiles-rebuild.nix similarity index 90% rename from nixos/modules/dotfiles-rebuild.nix rename to modules/dotfiles-rebuild.nix index 709ebaf..de6ac87 100644 --- a/nixos/modules/dotfiles-rebuild.nix +++ b/modules/dotfiles-rebuild.nix @@ -1,13 +1,13 @@ # Shared auto-rebuild-from-git service for homelab hosts. # # Every 15 min: git fetch origin, fast-forward main, and if there were any -# new commits run nixos-rebuild switch against `/nixos#`. +# new commits run nixos-rebuild switch against `#`. # # Assumes /etc/dotfiles is an already-cloned checkout of the dotfiles repo. { config, lib, pkgs, ... }: let dotfilesDir = "/etc/dotfiles"; - flakeRef = "${dotfilesDir}/nixos#${config.networking.hostName}"; + flakeRef = "${dotfilesDir}#${config.networking.hostName}"; in { environment.systemPackages = [ pkgs.git ]; diff --git a/nixos/fish.nix b/nixos/fish.nix index c32edaa..9d04f51 100644 --- a/nixos/fish.nix +++ b/nixos/fish.nix @@ -11,7 +11,7 @@ weather = "curl wttr.in/?T"; # TODO: rename and move 25_flakes into dotfiles nide = "nix develop ~/python-projects/25_flakes/$(basename (pwd)) -c $(which fish)"; - nixupdate = "cd ~/dotfiles/nixos && sudo nix flake update && sudo darwin-rebuild switch --flake ~/dotfiles/nixos#Daniel-Macbook-Air"; + nixupdate = "cd ~/dotfiles && sudo nix flake update && sudo darwin-rebuild switch --flake ~/dotfiles#Daniel-Macbook-Air"; }; interactiveShellInit = '' function fish_user_key_bindings diff --git a/nixos/hosts/sunken-ship.nix b/nixos/hosts/sunken-ship.nix index 2e8175c..db7d5f3 100644 --- a/nixos/hosts/sunken-ship.nix +++ b/nixos/hosts/sunken-ship.nix @@ -2,7 +2,7 @@ # # One-time on server: clone repo to /etc/dotfiles (root needs git access). # If private repo: use SSH (ssh:// or git@) and add root's key to GitHub, or use HTTPS + token. -# Then: sudo nixos-rebuild switch --flake /etc/dotfiles/nixos#sunken-ship +# Then: sudo nixos-rebuild switch --flake /etc/dotfiles#sunken-ship # If sudo git is not found: sudo nix run nixpkgs#git -- -C /etc/dotfiles pull origin main # Timer runs every 15 min: git fetch, pull if origin/main changed, rebuild. { config, lib, pkgs, ... }: diff --git a/nixos/sops/machines/phantom-ship/key.json b/sops/machines/phantom-ship/key.json similarity index 100% rename from nixos/sops/machines/phantom-ship/key.json rename to sops/machines/phantom-ship/key.json diff --git a/nixos/sops/machines/sunken-ship/key.json b/sops/machines/sunken-ship/key.json similarity index 100% rename from nixos/sops/machines/sunken-ship/key.json rename to sops/machines/sunken-ship/key.json diff --git a/nixos/sops/secrets/phantom-ship-age.key/secret b/sops/secrets/phantom-ship-age.key/secret similarity index 100% rename from nixos/sops/secrets/phantom-ship-age.key/secret rename to sops/secrets/phantom-ship-age.key/secret diff --git a/nixos/sops/secrets/phantom-ship-age.key/users/danny b/sops/secrets/phantom-ship-age.key/users/danny similarity index 100% rename from nixos/sops/secrets/phantom-ship-age.key/users/danny rename to sops/secrets/phantom-ship-age.key/users/danny diff --git a/nixos/sops/secrets/sunken-ship-age.key/secret b/sops/secrets/sunken-ship-age.key/secret similarity index 100% rename from nixos/sops/secrets/sunken-ship-age.key/secret rename to sops/secrets/sunken-ship-age.key/secret diff --git a/nixos/sops/secrets/sunken-ship-age.key/users/danny b/sops/secrets/sunken-ship-age.key/users/danny similarity index 100% rename from nixos/sops/secrets/sunken-ship-age.key/users/danny rename to sops/secrets/sunken-ship-age.key/users/danny diff --git a/nixos/sops/users/danny/key.json b/sops/users/danny/key.json similarity index 100% rename from nixos/sops/users/danny/key.json rename to sops/users/danny/key.json diff --git a/nixos/vars/per-machine/phantom-ship/zerotier/zerotier-identity-secret/machines/phantom-ship b/vars/per-machine/phantom-ship/zerotier/zerotier-identity-secret/machines/phantom-ship similarity index 100% rename from nixos/vars/per-machine/phantom-ship/zerotier/zerotier-identity-secret/machines/phantom-ship rename to vars/per-machine/phantom-ship/zerotier/zerotier-identity-secret/machines/phantom-ship diff --git a/nixos/vars/per-machine/phantom-ship/zerotier/zerotier-identity-secret/secret b/vars/per-machine/phantom-ship/zerotier/zerotier-identity-secret/secret similarity index 100% rename from nixos/vars/per-machine/phantom-ship/zerotier/zerotier-identity-secret/secret rename to vars/per-machine/phantom-ship/zerotier/zerotier-identity-secret/secret diff --git a/nixos/vars/per-machine/phantom-ship/zerotier/zerotier-identity-secret/users/danny b/vars/per-machine/phantom-ship/zerotier/zerotier-identity-secret/users/danny similarity index 100% rename from nixos/vars/per-machine/phantom-ship/zerotier/zerotier-identity-secret/users/danny rename to vars/per-machine/phantom-ship/zerotier/zerotier-identity-secret/users/danny diff --git a/nixos/vars/per-machine/phantom-ship/zerotier/zerotier-ip/value b/vars/per-machine/phantom-ship/zerotier/zerotier-ip/value similarity index 100% rename from nixos/vars/per-machine/phantom-ship/zerotier/zerotier-ip/value rename to vars/per-machine/phantom-ship/zerotier/zerotier-ip/value diff --git a/nixos/vars/per-machine/sunken-ship/zerotier/zerotier-identity-secret/machines/sunken-ship b/vars/per-machine/sunken-ship/zerotier/zerotier-identity-secret/machines/sunken-ship similarity index 100% rename from nixos/vars/per-machine/sunken-ship/zerotier/zerotier-identity-secret/machines/sunken-ship rename to vars/per-machine/sunken-ship/zerotier/zerotier-identity-secret/machines/sunken-ship diff --git a/nixos/vars/per-machine/sunken-ship/zerotier/zerotier-identity-secret/secret b/vars/per-machine/sunken-ship/zerotier/zerotier-identity-secret/secret similarity index 100% rename from nixos/vars/per-machine/sunken-ship/zerotier/zerotier-identity-secret/secret rename to vars/per-machine/sunken-ship/zerotier/zerotier-identity-secret/secret diff --git a/nixos/vars/per-machine/sunken-ship/zerotier/zerotier-identity-secret/users/danny b/vars/per-machine/sunken-ship/zerotier/zerotier-identity-secret/users/danny similarity index 100% rename from nixos/vars/per-machine/sunken-ship/zerotier/zerotier-identity-secret/users/danny rename to vars/per-machine/sunken-ship/zerotier/zerotier-identity-secret/users/danny diff --git a/nixos/vars/per-machine/sunken-ship/zerotier/zerotier-ip/value b/vars/per-machine/sunken-ship/zerotier/zerotier-ip/value similarity index 100% rename from nixos/vars/per-machine/sunken-ship/zerotier/zerotier-ip/value rename to vars/per-machine/sunken-ship/zerotier/zerotier-ip/value diff --git a/nixos/vars/per-machine/sunken-ship/zerotier/zerotier-network-id/value b/vars/per-machine/sunken-ship/zerotier/zerotier-network-id/value similarity index 100% rename from nixos/vars/per-machine/sunken-ship/zerotier/zerotier-network-id/value rename to vars/per-machine/sunken-ship/zerotier/zerotier-network-id/value diff --git a/nixos/vars/shared/zerotier-controller/zerotier-identity-secret/secret b/vars/shared/zerotier-controller/zerotier-identity-secret/secret similarity index 100% rename from nixos/vars/shared/zerotier-controller/zerotier-identity-secret/secret rename to vars/shared/zerotier-controller/zerotier-identity-secret/secret diff --git a/nixos/vars/shared/zerotier-controller/zerotier-identity-secret/users/danny b/vars/shared/zerotier-controller/zerotier-identity-secret/users/danny similarity index 100% rename from nixos/vars/shared/zerotier-controller/zerotier-identity-secret/users/danny rename to vars/shared/zerotier-controller/zerotier-identity-secret/users/danny diff --git a/nixos/vars/shared/zerotier-controller/zerotier-ip/value b/vars/shared/zerotier-controller/zerotier-ip/value similarity index 100% rename from nixos/vars/shared/zerotier-controller/zerotier-ip/value rename to vars/shared/zerotier-controller/zerotier-ip/value diff --git a/nixos/vars/shared/zerotier-controller/zerotier-network-id/value b/vars/shared/zerotier-controller/zerotier-network-id/value similarity index 100% rename from nixos/vars/shared/zerotier-controller/zerotier-network-id/value rename to vars/shared/zerotier-controller/zerotier-network-id/value