feat(mihomo): generate the config from the repo, not a copy in the live dir

`just mihomo-gen` runs generate.nu from the module and validates with the core
the service runs. ~/.config/mihomo keeps only sources.yaml and config.yaml.

.gitignore

@@ -32,3 +32,7 @@ env/
 .ruff_cache/
 .coverage
 htmlcov/
+
+# mihomo's private input and its subscription snapshots live in ~/.config/mihomo; guard a stray copy
+modules/nixos/desktop/networking/mihomo/sources.yaml
+modules/nixos/desktop/networking/mihomo/snapshots/

Justfile

@@ -290,6 +290,25 @@ dsh-web:
     NO_PROXY: "localhost,127.0.0.1,::1,[::1],192.168.5.100,192.168.5.178,10.0.0.0/8,172.16.0.0/12,192.168.0.0/16"
   } { ^dsh web --no-open }
 
+# Render the mihomo config from this repo and validate it with the live core.
+[linux]
+[group('services')]
+mihomo-gen:
+  #!/usr/bin/env nu
+  # ~/.config/mihomo holds only the private sources.yaml and the generated
+  # config.yaml. The generator and policy.yaml stay in the repository, so the
+  # live directory can never keep a stale copy of them.
+  let mod = ("{{ justfile() }}" | path dirname | path join modules nixos desktop networking mihomo)
+  nu ($mod | path join generate.nu)
+  # Validate with the core the service actually runs; a nixpkgs one may differ.
+  let core = (systemctl show mihomo.service -p ExecStart | str trim | split row "path=" | get 1 | split row " " | get 0)
+  let check = (^$core -t -f ($env.HOME | path join .config mihomo config.yaml) | complete)
+  if $check.exit_code != 0 {
+    print --stderr ($check.stderr | str trim)
+    exit $check.exit_code
+  }
+  print "validated -- restart: sudo systemctl restart mihomo.service"
+
 # Seed mihomo's geodata into the service's state dir, so a cold start needs no DNS.
 [linux]
 [group('services')]

modules/nixos/desktop/networking/mihomo/README.md

@@ -8,11 +8,14 @@ Native mihomo core + metacubexd dashboard, replacing the Clash Verge GUI. Enable
 ```sh
 cp sources.example.yaml ~/.config/mihomo/sources.yaml && chmod 600 ~/.config/mihomo/sources.yaml
 $EDITOR ~/.config/mihomo/sources.yaml           # fill in: secret, private_domains, providers
-nu generate.nu                                  # -> ~/.config/mihomo/config.yaml, mode 0600
-mihomo -t -f ~/.config/mihomo/config.yaml       # validate before restarting
+just mihomo-gen                                 # -> ~/.config/mihomo/config.yaml, mode 0600
 sudo systemctl restart mihomo.service           # dashboard: http://127.0.0.1:9090/ui
 ```
 
+`~/.config/mihomo` holds only `sources.yaml` and the generated `config.yaml` (plus geodata and the
+cache); the generator, `policy.yaml` and `gateway-config.nu` are run from here and never copied
+over. `just mihomo-gen` renders the config and validates it with the core the service runs.
+
 `sources.yaml` holds everything private (subscription URLs, secret, private domains) and stays out
 of the repo and the Nix store; the module loads `config.yaml` via `LoadCredential`. Generate the
 config before enabling the module, or the service will not start.

modules/nixos/desktop/networking/mihomo/sources.example.yaml

@@ -1,4 +1,4 @@
-# Copy to ~/.config/mihomo/sources.yaml, fill it in, then run `nu generate.nu`.
+# Copy to ~/.config/mihomo/sources.yaml, fill it in, then run `just mihomo-gen`.
 # Keep it mode 0600 and never commit it: subscription URLs, the dashboard
 # password and private domain names all live here.
 #