Add astoria NixOS host + Linux HM sub-bundle - #8
Merged
Conversation
astoria: Dell XPS 13 9300 sofa-companion thin-client. Sway + Moonlight +
LibreWolf on NixOS 26.11. Lanzaboote (Secure Boot) with TPM-sealed
cryptswap, disko-managed LUKS + Btrfs, sops-nix for activation secrets,
Restic-to-WebDAV backups.
Refactor modules/home to a universal bundle: modules/home/default.nix
self-selects the darwin or linux sub-bundle via a `hostSystem`
specialArg (a `pkgs`-dependent check in the imports list recurses
through `_module.args`). darwin + linux sub-bundles no longer
back-reference ../default.nix — the recursive reimport overflows the
stack before the module system's genericClosure dedup runs.
hosts/{NB2123,makima}/home.nix swap to `imports = [../../modules/home]`.
New modules/home/linux/: internet/librewolf, media/moonlight, thunar,
window-manager/{sway,waybar,mako,fuzzel,swaylock}. Each gated by
home.apps.<category>.<app>.enable, Tokyo Night palette pulled from
theme.nix.
Flake inputs: nixos-hardware, disko, sops-nix, nur, lanzaboote (v1.1.0
pinned tag). nixosConfigurations.astoria threads `inputs` through both
system specialArgs AND home-manager.extraSpecialArgs (HM's inner scope
doesn't inherit system specialArgs; shared modules like dev-shells and
claude-code destructure `inputs` at pattern-match).
.sops.yaml at repo root with two recipients (astoria host key + personal
recovery age key); hosts/astoria/secrets/astoria.yaml encrypted to both.
|
Warning Review limit reached
Next review available in: 48 minutes You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository. How can I continue?After more reviews become available, a review can be triggered using the To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews. How do review limits work?CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability. For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window. Please refer docs for additional details. Review details⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Pro Plus Run ID: 📒 Files selected for processing (1)
WalkthroughThis PR adds the Astoria NixOS host, encrypted SOPS secrets, Dell XPS hardware and storage configuration, Linux Home Manager modules, platform-aware flake wiring, operational documentation, and shared configuration updates. ChangesAstoria NixOS host
Estimated code review effort: 4 (Complex) | ~60 minutes Possibly related PRs
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 7
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@hosts/astoria/home.nix`:
- Line 29: Align home.stateVersion for astoria with the released NixOS version
being deployed, matching system.stateVersion rather than using the unreleased
"26.11" value; update both state-version settings consistently if needed.
In `@hosts/astoria/README.md`:
- Line 6: Replace the absolute local path in the README’s Design plan reference
with a repository-relative link to a committed design-plan document, adding or
committing that document if necessary. Remove the author-specific filesystem
path while preserving the design plan reference.
- Around line 192-194: Update the Astoria hardware verification instructions to
avoid piping the mutable GitHub response directly into sh. In the README command
sequence, download a commit-pinned verify-hardware.sh, verify its checksum
before execution, and then run the verified local script; alternatively instruct
users to execute the checked-out repository copy.
- Line 30: Update the WebDAV curl example to avoid passing the app password in
the command-line argument; use username-only authentication so curl prompts
securely for the password, or reference a credentials file with 0600
permissions.
In `@hosts/astoria/verify-hardware.sh`:
- Around line 55-62: Guard the health calculations in both the charge_full and
energy_full branches against zero or invalid now/design values. Validate both
counters after reading them and only perform the percentage arithmetic and
health printf when they are valid and design is nonzero; otherwise skip the
health calculation safely.
- Around line 33-39: Update the platform profile check in verify-hardware.sh to
read platform_profile_choices first and branch on whether its contents are
non-empty, not merely whether the file is readable. Treat an empty file as
unsupported by emitting the existing no-op warning, and only print the choices
and active profile when content is present.
- Line 42: Update the Goodix device check around the lsusb/grep pipeline so the
“no Goodix device found” fallback runs when lsusb is unavailable or grep finds
no matching device, while preserving the indented matching-device output. Ensure
the fallback is evaluated from the device-detection result rather than sed’s
successful output.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro Plus
Run ID: 41df3b41-80e5-46cc-aa7b-746e4a9ae6d1
⛔ Files ignored due to path filters (1)
flake.lockis excluded by!**/*.lock
📒 Files selected for processing (26)
.sops.yamlflake.nixhosts/NB2123/home.nixhosts/astoria/README.mdhosts/astoria/default.nixhosts/astoria/hardware.nixhosts/astoria/home.nixhosts/astoria/secrets.nixhosts/astoria/secrets/astoria.yamlhosts/astoria/verify-hardware.shhosts/makima/home.nixmodules/home/darwin/default.nixmodules/home/default.nixmodules/home/fonts.nixmodules/home/linux/default.nixmodules/home/linux/internet/default.nixmodules/home/linux/internet/librewolf.nixmodules/home/linux/media/default.nixmodules/home/linux/media/moonlight.nixmodules/home/linux/thunar.nixmodules/home/linux/window-manager/default.nixmodules/home/linux/window-manager/fuzzel.nixmodules/home/linux/window-manager/mako.nixmodules/home/linux/window-manager/sway.nixmodules/home/linux/window-manager/swaylock.nixmodules/home/linux/window-manager/waybar.nix
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@hosts/astoria/README.md`:
- Line 218: Update the shell code fence in the README section identified by the
Markdownlint warning to include the bash language identifier, changing the
opening fence to a bash-specific fence while leaving the command content
unchanged.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro Plus
Run ID: c1e84cff-1bfa-468f-bfc1-9816d5c63922
📒 Files selected for processing (2)
hosts/astoria/README.mdhosts/astoria/verify-hardware.sh
🚧 Files skipped from review as they are similar to previous changes (1)
- hosts/astoria/verify-hardware.sh
There was a problem hiding this comment.
Actionable comments posted: 2
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (1)
hosts/astoria/README.md (1)
229-233: 🔒 Security & Privacy | 🟠 Major | ⚡ Quick winUse the lock-pinned disko executable.
hosts/astoria/README.mdrunsgithub:nix-community/diskodirectly with--mode destroy,format,mount, while the flake already has a lock-pinnedinputs.disko. Point the install step at the repository’s pinned disko input/commit so future upstream changes cannot change this destructive operation.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@hosts/astoria/README.md` around lines 229 - 233, Update the destructive disko command in the astoria README to invoke the repository’s lock-pinned disko input instead of the unpinned github:nix-community/disko reference, while preserving the existing destroy, format, and mount modes.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@hosts/astoria/README.md`:
- Around line 126-129: Update the “User password hash” command in the README so
/tmp/astoria-hash is explicitly created with permissions 0600 rather than
relying on the caller’s umask, while preserving the existing temporary-file
workflow and mkpasswd output.
- Around line 27-28: Update the rclone obscure command in the README to provide
APP_PASSWORD through standard input rather than as a command-line argument,
while preserving the nix-shell invocation and ensuring the plaintext password is
not exposed in argv or shell history.
---
Outside diff comments:
In `@hosts/astoria/README.md`:
- Around line 229-233: Update the destructive disko command in the astoria
README to invoke the repository’s lock-pinned disko input instead of the
unpinned github:nix-community/disko reference, while preserving the existing
destroy, format, and mount modes.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro Plus
Run ID: 109d38ca-6fd4-4b5c-bfb1-a09b7d040d2b
📒 Files selected for processing (1)
hosts/astoria/README.md
brutcha
commented
Aug 2, 2026
README: - fold in the post-install fix list (tuigreet path, WiFi comment, SATA/RAID BIOS gotcha, Secure Boot key-reset gotcha) - restructure: promote Rebuild/Update/Rollback and the rest of Operations reference to flat top-level sections, condense the one-time install phases (secrets setup, dev-machine key generation) into short reference docs pointing at secrets.nix and upstream tooling docs - rework the install flow for nix-community/nixos-images (flakes enabled by default, root SSH from boot) instead of the official minimal ISO - add a References section hardware.nix: resolve the now-confirmed AX201 WiFi hedge comment, add the missing CPU_BOOST_ON_AC TLP setting default.nix: enable programs.dconf (portal dark-mode signal backing), wire in sudoers.nix sudoers.nix: NOPASSWD sudo for `nixos-rebuild switch` screenshot.nix: grim/slurp/swappy region + full-screen capture imv.nix: default image viewer, wired as default app for common image mimetypes thunar.nix: drop the deprecated xfce.* package namespace librewolf.nix: fix GitHub login not persisting across restarts (clearOnShutdown_v2, LibreWolf migrated off the old clearOnShutdown.* prefs), fix prefers-color-scheme being forced to light for all sites (swap resistFingerprinting for fingerprintingProtection with a CSSPrefersColorScheme carve-out) waybar.nix/sway.nix/home.nix: SketchyBar-inspired restyle (workspace pills, icons, matching GTK font), nmtui/pavucontrol quick-launch on click, dconf dark-mode key, smart_borders on single-window workspaces nvim: fix treesitter build hook double-invocation
Owner
Author
|
@coderabbitai review |
✅ Action performedReview finished.
|
There was a problem hiding this comment.
Actionable comments posted: 9
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (3)
hosts/astoria/README.md (3)
351-354: 🎯 Functional Correctness | 🟡 Minor | ⚡ Quick winMake the post-cleanup verification runnable.
Step 5 exits the shell that defines
SCRATCH. Step 6 runs afterward, so a new shell will not have that variable andls -la "$SCRATCH"cannot verify the deleted path. Verify before exiting, or check fixed platform-specific parent paths from the new shell.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@hosts/astoria/README.md` around lines 351 - 354, Reorder the cleanup verification in the documented steps so the check using "$SCRATCH" runs before step 5 exits the shell, or replace it with fixed platform-specific parent paths that work afterward. Preserve the macOS snapshot verification and ensure all commands remain runnable in their stated shell context.
344-347: 🔒 Security & Privacy | 🟡 Minor | ⚡ Quick winDo not hide recovery-key cleanup failures.
The trap suppresses
shrederrors and then continues withrm -rf. Ifshredis unavailable or fails, the documented “shred discipline” silently degrades. Validate the cleanup tool before pasting the key, or use an explicit platform-specific RAM-disk cleanup path.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@hosts/astoria/README.md` around lines 344 - 347, Update the cleanup trap instructions around the documented trap to avoid suppressing shred failures: validate that the cleanup tool is available and succeeds before pasting the recovery key, or replace it with an explicit platform-specific RAM-disk cleanup path. Preserve cleanup of the scratch directory and ejection of ARamDisk while ensuring shred-discipline failures are visible rather than silently ignored.
210-215: 🔒 Security & Privacy | 🟠 Major | 🏗️ Heavy liftCorrect the PCR 7 threat model.
PCR 7 captures the Secure Boot policy state, not arbitrary ESP file contents. The current text makes it sound as if Secure Boot enables firmware measurement of an already-planted ESP payload before TPM sealing, which misstates PCRs
0+2+7. Replace this with an exact measured-boot policy and tested recovery path, or say ESP-content integrity is not covered by this enrollment.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@hosts/astoria/README.md` around lines 210 - 215, Correct the “Single-sitting rule” section to remove the claim that PCR 7 measures arbitrary ESP payloads when Secure Boot is enabled. State that PCR 7 reflects Secure Boot policy state, and either document an exact measured-boot policy with a tested recovery path or explicitly state that this enrollment does not protect ESP-content integrity.
🧹 Nitpick comments (1)
hosts/astoria/README.md (1)
286-290: 🔒 Security & Privacy | 🔵 TrivialPresent the BIOS password choice as a security trade-off.
The README recommends leaving the BIOS administrator password unset to preserve TLP writes. That leaves firmware settings available to anyone with physical access. PCR sealing controls TPM key release; it does not prevent firmware or boot-configuration changes. Document both options and require an explicit choice after testing TLP behavior. (freedesktop.org)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@hosts/astoria/README.md` around lines 286 - 290, Update the BIOS administrator password guidance in the README to present an explicit security trade-off: an unset password preserves TLP Dell charge-threshold writes, while setting one protects firmware and boot configuration from physical access but may break those writes. State that PCR sealing only controls TPM key release, and require testing TLP behavior before choosing the preferred option.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@hosts/astoria/README.md`:
- Around line 154-161: Update the SSH key transfer instructions around the scp
and ssh commands to first compare the installer’s host-key fingerprint from its
console, then require StrictHostKeyChecking=yes with a dedicated known_hosts
file for both connections. Ensure the temporary /tmp/astoria_host_key copy on
the development machine is removed after a successful transfer, while preserving
the remote ownership, mode, and shredding steps.
- Around line 164-169: Update the README command around ssh-keygen -y to avoid
the unguarded pipeline: derive the public key into a temporary file, fail
immediately if ssh-keygen fails, and only then install the verified temporary
output as the .pub file with the existing ownership and permissions. Clean up
the temporary file appropriately.
- Around line 105-107: Update the dotfiles checkout instructions around the
clone command to require a trusted commit or tag rather than the repository’s
mutable default branch, then verify the checkout resolves to that expected
revision before proceeding. Ensure the verified revision is the one used by the
later nixos-install invocation.
- Around line 134-136: Reorder the arguments in the documented nix run command
so --extra-experimental-features appears before the '.#disko' installable, while
preserving the existing disko mode, format, mount, and flake arguments.
- Around line 177-180: Update the installer sbctl invocation in the documented
create-keys command to pass the global --disable-landlock flag after Nix’s --
and before create-keys, while leaving the remaining key export arguments
unchanged.
- Around line 71-74: Update the recovery age key guidance around the
&brutcha_recovery anchor to require a distinct recovery recipient/keypair for
each host rather than reusing one key across hosts. If shared recovery remains
supported, document it in an explicit shared-blast-radius section with the
required rotation steps before instructing users to add the key.
- Around line 51-55: Update the Astoria README description to state that the
host SSH key and recovery age key are alternative SOPS recipients: the host key
supports boot-time decryption, while the recovery age key remains off-host for
editing or recovery. Clarify that Astoria does not need both keys installed.
In `@hosts/astoria/sudoers.nix`:
- Around line 6-8: Remove the wildcarded NOPASSWD nixos-rebuild rule from the
sudo configuration. If passwordless switching is required, replace it with a
root-owned wrapper command that accepts no caller-controlled arguments and
targets a root-owned flake path; otherwise remove the NOPASSWD permission
entirely.
In `@modules/home/linux/window-manager/screenshot.nix`:
- Around line 20-22: Update the screenshot-region script generated by
writeShellScriptBin to enable pipefail, capture slurp’s geometry before invoking
grim, and exit immediately when selection is cancelled or empty. Preserve the
existing grim-to-swappy pipeline for valid geometry while ensuring failures from
either command propagate as a nonzero script status.
---
Outside diff comments:
In `@hosts/astoria/README.md`:
- Around line 351-354: Reorder the cleanup verification in the documented steps
so the check using "$SCRATCH" runs before step 5 exits the shell, or replace it
with fixed platform-specific parent paths that work afterward. Preserve the
macOS snapshot verification and ensure all commands remain runnable in their
stated shell context.
- Around line 344-347: Update the cleanup trap instructions around the
documented trap to avoid suppressing shred failures: validate that the cleanup
tool is available and succeeds before pasting the recovery key, or replace it
with an explicit platform-specific RAM-disk cleanup path. Preserve cleanup of
the scratch directory and ejection of ARamDisk while ensuring shred-discipline
failures are visible rather than silently ignored.
- Around line 210-215: Correct the “Single-sitting rule” section to remove the
claim that PCR 7 measures arbitrary ESP payloads when Secure Boot is enabled.
State that PCR 7 reflects Secure Boot policy state, and either document an exact
measured-boot policy with a tested recovery path or explicitly state that this
enrollment does not protect ESP-content integrity.
---
Nitpick comments:
In `@hosts/astoria/README.md`:
- Around line 286-290: Update the BIOS administrator password guidance in the
README to present an explicit security trade-off: an unset password preserves
TLP Dell charge-threshold writes, while setting one protects firmware and boot
configuration from physical access but may break those writes. State that PCR
sealing only controls TPM key release, and require testing TLP behavior before
choosing the preferred option.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro Plus
Run ID: d8dc6d07-9bab-4816-802a-d5aeb84a6bd8
📒 Files selected for processing (18)
.sops.yamlconfig/nvim/lua/plugins/init.luaflake.nixhosts/astoria/README.mdhosts/astoria/default.nixhosts/astoria/hardware.nixhosts/astoria/home.nixhosts/astoria/secrets/astoria.yamlhosts/astoria/sudoers.nixmodules/home/development/git.nixmodules/home/linux/internet/librewolf.nixmodules/home/linux/media/default.nixmodules/home/linux/media/imv.nixmodules/home/linux/thunar.nixmodules/home/linux/window-manager/default.nixmodules/home/linux/window-manager/screenshot.nixmodules/home/linux/window-manager/sway.nixmodules/home/linux/window-manager/waybar.nix
🚧 Files skipped from review as they are similar to previous changes (9)
- .sops.yaml
- modules/home/linux/window-manager/default.nix
- hosts/astoria/secrets/astoria.yaml
- modules/home/linux/media/default.nix
- modules/home/linux/thunar.nix
- modules/home/linux/window-manager/waybar.nix
- hosts/astoria/hardware.nix
- modules/home/linux/window-manager/sway.nix
- hosts/astoria/default.nix
…ents Security/correctness fixes from an review: - sudoers.nix: pin exact nixos-rebuild invocations, no wildcard (was a passwordless arbitrary-flake privesc surface) - README: scp the SSH host key's .pub from the vault instead of deriving it on the installer (removes an unguarded pipe), shred the dev-machine's temp copy, fix disko's nix run arg order, add missing sbctl --disable-landlock, correct PCR 7 (policy state, not payload measurement) in two spots, make shred failures visible instead of swallowed, fix a cleanup check referencing an already-exited shell's var - screenshot.nix: screenshot-region now exits cleanly on a cancelled/empty slurp selection instead of feeding grim garbage geometry
Owner
Author
|
@coderabbitai review |
✅ Action performedReview finished.
|
There was a problem hiding this comment.
♻️ Duplicate comments (1)
hosts/astoria/sudoers.nix (1)
5-7: 🔒 Security & Privacy | 🔴 Critical | ⚡ Quick winRemove the cwd-dependent
. # astoriarule.Line 6 allows
brutchato runnixos-rebuild switch --flake . # astoriaas root. Sudo preserves the caller’s current directory by default, and--flake .resolves against that directory at runtime.brutchacancdto any directory containing a craftedflake.nixwith anastoriaoutput and then use this NOPASSWD rule to makenixos-rebuildbuild and switch that flake as root. Keep the absolute/etc/nixos # astorialine; add a fixedcwd=/runcwdif the relative form must remain.🔒 Drop the cwd-dependent rule
{ security.sudo.extraConfig = lib.mkAfter '' - brutcha ALL=(root) NOPASSWD: /run/current-system/sw/bin/nixos-rebuild switch --flake .\`#astoria` brutcha ALL=(root) NOPASSWD: /run/current-system/sw/bin/nixos-rebuild switch --flake /etc/nixos\`#astoria`🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@hosts/astoria/sudoers.nix` around lines 5 - 7, Remove the cwd-dependent sudo rule from security.sudo.extraConfig that invokes nixos-rebuild with --flake .\`#astoria`, while preserving the absolute /etc/nixos\`#astoria` rule.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Duplicate comments:
In `@hosts/astoria/sudoers.nix`:
- Around line 5-7: Remove the cwd-dependent sudo rule from
security.sudo.extraConfig that invokes nixos-rebuild with --flake .\`#astoria`,
while preserving the absolute /etc/nixos\`#astoria` rule.
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro Plus
Run ID: b5cf644b-63d2-497a-9873-17e24e5bd0a6
📒 Files selected for processing (7)
hosts/astoria/README.mdhosts/astoria/default.nixhosts/astoria/home.nixhosts/astoria/sudoers.nixmodules/home/development/git.nixmodules/home/linux/window-manager/screenshot.nixmodules/home/linux/window-manager/sway.nix
🚧 Files skipped from review as they are similar to previous changes (4)
- modules/home/development/git.nix
- hosts/astoria/home.nix
- modules/home/linux/window-manager/screenshot.nix
- hosts/astoria/README.md
…pers, tweak waybar nixpkgs-unstable removed tokyonight-gtk-theme after the flake bump (its package.nix still depended on the now-dead gtk-engine-murrine), so it's vendored locally in pkgs/tokyonight-gtk-theme with that dependency dropped. Renamed the shared `utils` lib to `helpers` so it no longer collides with NixOS's internal `utils` module arg, letting astoria pull in the same pkgs/ overlay darwin hosts already use instead of a one-off overlay. Also switched claude-code's `plugins` to an attrset so plugin directory names stay stable instead of deriving from a store hash. Waybar: tighter module padding, and a sway/language module to show the active us/cz keyboard layout.
Owner
Author
|
@coderabbitai review |
✅ Action performedReview finished.
|
…ble waybar workspaces LibreWolf, Ghostty, and Moonlight are persistently assigned to workspaces 1, 2, and 3 respectively, and for_window focus rules make opening any of the three (from fuzzel or a keybinding) jump straight to its workspace. None of them autostart at login — they're placed correctly whenever you launch them yourself. Moonlight is additionally launched lazily via mod+3, which checks the Sway window tree (its wrapped process name doesn't match a simple pgrep) so repeated presses don't spawn duplicate instances. waybar now shows workspaces 1-5 at all times via persistent-workspaces, with a new dim .empty style so empty workspaces read distinctly from ones with an unfocused app open.
added 3 commits
August 3, 2026 19:07
Missed staging this alongside the previous commit: flake.nix now calls darwinHosts.mkHomeConfig/mkHomebrewConfig/mkDarwinPkgs instead of the inline definitions that used to live here.
Missed staging this alongside the previous commit: flake.nix now calls darwinHosts.mkHomeConfig/mkHomebrewConfig/mkDarwinPkgs instead of the inline definitions that used to live here.
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@hosts/NB2123/home.nix`:
- Around line 33-36: Update the corpPlugins construction around lib.listToAttrs
so plugins without an explicit p.name cannot silently overwrite entries when
baseNameOf p.path duplicates another key. Require every plugin to define name,
or validate that all derived names are unique before invoking lib.listToAttrs,
while preserving the existing value construction.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro Plus
Run ID: 0eb1318b-1ab2-4e5e-a598-7ffcce60e2b6
📒 Files selected for processing (1)
hosts/NB2123/home.nix
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
astoria: Dell XPS 13 9300 sofa-companion thin-client. Sway + Moonlight + LibreWolf on NixOS 26.11. Lanzaboote (Secure Boot) with TPM-sealed cryptswap, disko-managed LUKS + Btrfs, sops-nix for activation secrets, Restic-to-WebDAV backups.
Refactor modules/home to a universal bundle: modules/home/default.nix self-selects the darwin or linux sub-bundle via a
hostSystemspecialArg (apkgs-dependent check in the imports list recurses through_module.args). darwin + linux sub-bundles no longer back-reference ../default.nix — the recursive reimport overflows the stack before the module system's genericClosure dedup runs. hosts/{NB2123,makima}/home.nix swap toimports = [../../modules/home].New modules/home/linux/: internet/librewolf, media/moonlight, thunar, window-manager/{sway,waybar,mako,fuzzel,swaylock}. Each gated by home.apps...enable, Tokyo Night palette pulled from theme.nix.
Flake inputs: nixos-hardware, disko, sops-nix, nur, lanzaboote (v1.1.0 pinned tag). nixosConfigurations.astoria threads
inputsthrough both system specialArgs AND home-manager.extraSpecialArgs (HM's inner scope doesn't inherit system specialArgs; shared modules like dev-shells and claude-code destructureinputsat pattern-match)..sops.yaml at repo root with two recipients (astoria host key + personal recovery age key); hosts/astoria/secrets/astoria.yaml encrypted to both.
Summary by CodeRabbit