starred/nix-config-ryan4yin
1
0 Fork 0
mirror of https://github.com/ryan4yin/nix-config.git synced 2026-11-13 12:13:36 +01:00
Code Issues Packages Projects Releases 10 Wiki Activity

docs(agents): convert prose tables to grouped lists

Browse Source 
Assisted-by: DeepSeek Harness (claude-opus-5-5, qwen3.8-flash-next iq3)
This commit is contained in:
Ryan Yin committed 2026-10-10 19:49:44 +08:00
1 parent d808dd914d
commit 0e70582642
9 files changed
+443 -200
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

.agents/skills/nix-config-new-host/SKILL.md
+9 -7
View File
@@ -27,13 +27,15 @@ in [hosts/README.md](../../../hosts/README.md).
## 1. Pick the template
| New host | Copy from |
| ------------------------ | ------------------------------------------------------------------------------------------------- |
| Desktop workstation | `hosts/idols-ai/` + `outputs/x86_64-linux/src/idols-ai.nix` |
| Homelab server / VM host | `hosts/12kingdoms-shoryu/` + `outputs/x86_64-linux/src/12kingdoms-shoryu.nix` |
| Apple Silicon Linux | `hosts/12kingdoms-shoukei/` + `outputs/aarch64-linux/src/12kingdoms-shoukei.nix` |
| macOS | `hosts/darwin-fern/` + `outputs/aarch64-darwin/src/fern.nix` (`darwinConfigurations`, no Colmena) |
| MicroVM guest | `hosts/k8s/k3s-test-1-worker-1/` + `outputs/x86_64-linux/src/k3s-test-1-worker-1.nix` |
- Desktop workstation: `hosts/idols-ai/` + `outputs/x86_64-linux/src/idols-ai.nix`
- Homelab server / VM host: `hosts/12kingdoms-shoryu/` +
`outputs/x86_64-linux/src/12kingdoms-shoryu.nix`
- Apple Silicon Linux: `hosts/12kingdoms-shoukei/` +
`outputs/aarch64-linux/src/12kingdoms-shoukei.nix`
- macOS: `hosts/darwin-fern/` + `outputs/aarch64-darwin/src/fern.nix` (`darwinConfigurations`, no
Colmena)
- MicroVM guest: `hosts/k8s/k3s-test-1-worker-1/` +
`outputs/x86_64-linux/src/k3s-test-1-worker-1.nix`
A MicroVM guest is also registered in its VM host's `microvm.nix`; deploy it with the procedure in
WA-026 of [WORKAROUNDS.md](../../../WORKAROUNDS.md), not `just microvm-deploy`. On a VM host with
.agents/skills/nix-config-secrets/SKILL.md
+15 -13
View File
@@ -19,10 +19,10 @@ Read [secrets/README.md](../../../secrets/README.md) for the concepts and the re
Two age flows live in `~/codes/nix-secrets`, and a file belongs to exactly one.
| Flow | Shape | Consumed as | `flake.lock` bump |
| ------------------------------- | -------------------------------------------------------------- | -------------------------------------------------------- | ----------------- |
| **agenix** (`secrets.nix`) | static and one-way: repository → host, decrypted at activation | `/run/agenix/<name>` or an `environment.etc` copy | yes |
| **dotfiles sync** (`dotfiles/`) | changes on the host; `save`/`restore` are manual, outside Nix | a real file under `$HOME`, edited by hand or by its tool | **no** |
- **agenix** (`secrets.nix`): static and one-way, repository → host, decrypted at activation.
Consumed as `/run/agenix/<name>` or an `environment.etc` copy; needs a `flake.lock` bump.
- **dotfiles sync** (`dotfiles/`): changes on the host; `save`/`restore` are manual, outside Nix.
Consumed as a real file under `$HOME`, edited by hand or by its tool; **no** lock bump.
agenix is for the secrets that barely change and that a Nix module or service reads from the
decrypted path. Everything else is a synced dotfile: Nix does not read it, it changes often, or it
@@ -62,15 +62,17 @@ must not get one back.
## 1. Where the pieces live
| Piece | Location |
| --------------------------------------------- | ---------------------------------------------------------------------------------------------- |
| Recipient list, encrypted files, `agenix` CLI | `~/codes/nix-secrets` (private; `git@github.com:ryan4yin/nix-secrets.git`) |
| The pinned revision of that repository | `flake.lock`, input `mysecrets` |
| Declaration: file, mode/owner, `/etc` copy | `secrets/nixos.nix`, `secrets/darwin.nix` |
| Which host gets which group | `modules.secrets.<group>.enable` in `outputs/<system>/src/<name>.nix` or a host module |
| Consumers | modules reading `config.age.secrets."<name>".path` (default `/run/agenix/<name>`) |
| Decryption key | `age.identityPaths`: the host's SSH host key; `/persistent/etc/ssh/...` on a preservation host |
| Secret-bearing dotfiles edited in place | `~/codes/nix-secrets/dotfiles/` — private, not a flake input, no entry in `secrets.nix` |
- Recipient list, encrypted files, `agenix` CLI: `~/codes/nix-secrets` (private;
`git@github.com:ryan4yin/nix-secrets.git`)
- The pinned revision of that repository: `flake.lock`, input `mysecrets`
- Declaration (file, mode/owner, `/etc` copy): `secrets/nixos.nix`, `secrets/darwin.nix`
- Which host gets which group: `modules.secrets.<group>.enable` in `outputs/<system>/src/<name>.nix`
or a host module
- Consumers: modules reading `config.age.secrets."<name>".path` (default `/run/agenix/<name>`)
- Decryption key: `age.identityPaths` — the host's SSH host key; `/persistent/etc/ssh/...` on a
preservation host
- Secret-bearing dotfiles edited in place: `~/codes/nix-secrets/dotfiles/` — private, not a flake
input, no entry in `secrets.nix`
The private repository keeps its `.age` files in `desktop/` (only desktops decrypt them), `server/`
(any server), and `certs/`; `public/` holds publishable plaintext, not `.age`.
.agents/skills/nix-config-umu-game/SKILL.md
+11 -15
View File
@@ -16,24 +16,20 @@ specific installed release; then select it with `PROTONPATH` and pin that path i
## Bundled files
| Path | What |
| ------------------------------- | --------------------------------------------------- |
| `scripts/umu-install.nu` | installer and template renderer |
| `scripts/templates/*.tpl` | non-executable templates; placeholders use `@NAME@` |
| `scripts/tests/test_install.py` | offline regression tests |
- `scripts/umu-install.nu`: installer and template renderer
- `scripts/templates/*.tpl`: non-executable templates; placeholders use `@NAME@`
- `scripts/tests/test_install.py`: offline regression tests
## Layout
| Path | What |
| ------------------------------- | -------------------------------------------------------- |
| `~/Games/global.conf` | optional, sourced by every game before its own `conf` |
| `~/Games/<name>/prefix` | the Wine prefix (`WINEPREFIX`) |
| `~/Games/<name>/conf` | optional per-game overrides (`ENABLE_MANGOHUD=0`, ...) |
| `~/Games/<name>/prelaunch` | optional executable, run before every launch |
| `~/Games/<name>/run` | generated launcher |
| `~/Games/<name>/exec` | generated helper: `exec <exe-or-tool> [args...]` |
| `~/Games/<name>/<name>.desktop` | generated desktop entry |
| `~/Games/<name>/uninstall` | generated: drop the desktop entry and (with `y`) the dir |
- `~/Games/global.conf`: optional, sourced by every game before its own `conf`
- `~/Games/<name>/prefix`: the Wine prefix (`WINEPREFIX`)
- `~/Games/<name>/conf`: optional per-game overrides (`ENABLE_MANGOHUD=0`, ...)
- `~/Games/<name>/prelaunch`: optional executable, run before every launch
- `~/Games/<name>/run`: generated launcher
- `~/Games/<name>/exec`: generated helper: `exec <exe-or-tool> [args...]`
- `~/Games/<name>/<name>.desktop`: generated desktop entry
- `~/Games/<name>/uninstall`: generated: drop the desktop entry and (with `y`) the dir
Run, from the repo root:
.agents/skills/nix-config-update/SKILL.md
+9 -8
View File
@@ -43,14 +43,15 @@ deploying the result to any host.
## 2. Run the update
| Goal | Command | Notes |
| ------------------------ | --------------------------- | -------------------------------------------------------------------------- |
| Everything | `just up` | Updates and commits the lock file automatically; audit before pushing |
| One input | `just upp <input>` | Same, for a single input, e.g. `just upp catppuccin`; audit before pushing |
| The nixpkgs family | `just up-nix` | Updates `nixpkgs-stable`/`-master`/`-darwin`/`-patched`; **not `nixpkgs`** |
| Pin `nixpkgs` | `just override-pkgs <hash>` | Pin `nixpkgs` to a known-good Hydra commit |
| Update but keep it dirty | `nix flake update <input>` | Leaves the change uncommitted so you can inspect it first |
| Nix itself (macOS) | `just nix-upgrade` | `determinate-nixd upgrade`; macOS only |
- Everything: `just up` — updates and commits the lock file automatically; audit before pushing
- One input: `just upp <input>` — same, for a single input, e.g. `just upp catppuccin`; audit before
pushing
- The nixpkgs family: `just up-nix` — updates `nixpkgs-stable`/`-master`/`-darwin`/`-patched`; **not
`nixpkgs`**
- Pin `nixpkgs`: `just override-pkgs <hash>` — pin `nixpkgs` to a known-good Hydra commit
- Update but keep it dirty: `nix flake update <input>` — leaves the change uncommitted so you can
inspect it first
- Nix itself (macOS): `just nix-upgrade` — `determinate-nixd upgrade`; macOS only
After an update, read `git diff flake.lock`: it lists exactly which inputs moved and by how many
commits. Because `just up` and `just upp` commit automatically, either use
.agents/skills/nixpkgs-review/SKILL.md
+16 -15
View File
@@ -19,13 +19,12 @@ unrelated packages; selecting a large source package can trigger substantial dow
## Choose the runner
| Situation | Runner |
| ---------------------------------------------------- | ----------------------------------------------------------- |
| One package, one Linux architecture, local debugging | local `nixpkgs-review` |
| Need to inspect the package interactively | local review shell |
| Need aarch64/Darwin or a reproducible remote build | `just pkg-review <pr>` |
| Only one package's passthru tests matter | `just pkg-test <pr> <pname>` or local `--package`/`--tests` |
| Review a local commit proposed for an upstream PR | `nixpkgs-review rev <rev>` |
- One package, one Linux architecture, local debugging: local `nixpkgs-review`
- Need to inspect the package interactively: local review shell
- Need aarch64/Darwin or a reproducible remote build: `just pkg-review <pr>`
- Only one package's passthru tests matter: `just pkg-test <pr> <pname>` or local
`--package`/`--tests`
- Review a local commit proposed for an upstream PR: `nixpkgs-review rev <rev>`
The local tool defaults to the current system. This machine is `x86_64-linux`; do not imply that a
successful local result covers Darwin or aarch64. Use `--systems` explicitly when builders or
@@ -116,14 +115,16 @@ check repeatable and catch failures such as a GUI process exiting before its win
Examples of the smallest useful check:
| Change | Additional evidence |
| -------------------------------------- | --------------------------------------------------------------------------------------------------------- |
| CLI or library | Run `--version`/help and one representative operation |
| GUI package | Launch it locally for a simple check; use a NixOS test for startup/crash regressions |
| Service or module | Evaluate the relevant option, inspect generated units/config, and build the affected host |
| Sandbox, permission, or network policy | Inspect the effective wrapper/unit and test the allowed/denied behavior without exposing secrets |
| Driver, kernel, or hardware support | Build the relevant configuration and perform a host-specific check; do not claim other architectures work |
| Package with passthru tests | Build selected tests, then run a focused smoke test if the package can be exercised |
- CLI or library: run `--version`/help and one representative operation
- GUI package: launch it locally for a simple check; use a NixOS test for startup/crash regressions
- Service or module: evaluate the relevant option, inspect generated units/config, and build the
affected host
- Sandbox, permission, or network policy: inspect the effective wrapper/unit and test the
allowed/denied behavior without exposing secrets
- Driver, kernel, or hardware support: build the relevant configuration and perform a host-specific
check; do not claim other architectures work
- Package with passthru tests: build selected tests, then run a focused smoke test if the package
can be exercised
Record the result as one of: existing tests sufficient, local smoke check sufficient, upstream test
PR recommended, or blocked by missing hardware/architecture. A test improvement should normally be a