Add R2 rclone mount apps under ~/darkmatter

[cooper (czxtm)]

Summary

• Add a flake-parts module (modules/flake-parts/r2.nix, exported as flakeModules.r2) that exposes three runnable apps backed by rclone:
  • configure-darkmatter-r2 — one-time interactive setup of the darkmatter-r2 rclone remote (reads R2_ACCOUNT_ID / R2_ACCESS_KEY_ID / R2_SECRET_ACCESS_KEY if set, otherwise prompts).
  • mount-darkmatter — mounts every configured bucket (or a single one passed as an arg) under ~/darkmatter/<name> via rclone mount --daemon.
  • unmount-darkmatter — unmounts via fusermount3/fusermount/umount as appropriate.
• Configure default mounts at ~/darkmatter/{public,team,personal} backed by darkmatter-{public,team,personal} R2 buckets. Bucket names, mount root (DARKMATTER_BASE_DIR env override), vfs-cache-mode, and per-mount extraMountArgs are all configurable through darkmatter.r2 options.
• Enable the module by default in this repo's flake.nix and update the README's "Shared Flake Utilities" section to document the new commands (replaces the previously-documented but unimplemented rclone-s3 snippet).

Test plan

• nix flake check evaluates clean on x86_64-linux and aarch64-darwin
• nix run .#configure-darkmatter-r2 creates a working darkmatter-r2 rclone remote
• nix run .#mount-darkmatter mounts all three buckets under ~/darkmatter
• nix run .#mount-darkmatter -- team mounts only the team bucket
• nix run .#unmount-darkmatter releases all mounts cleanly
• Verify on macOS (requires macFUSE) and Linux

https://claude.ai/code/session_01RX1FoRF99mdTXmX5VR5ruH

---

Generated by Claude Code

[cursor]

PR Summary

Medium Risk
Adds new runnable apps that configure credentials and mount/unmount R2 buckets via FUSE, and enables them by default in the flake; issues could affect developer environments or leak mounts/paths if misused. Also changes the agenix-rekey workflow file generation, which could impact CI if formatting/output differs.

Overview
Adds a new flakeModules.r2 flake-parts module that exposes configure-darkmatter-r2, mount-darkmatter, and unmount-darkmatter apps for mounting Cloudflare R2 buckets under ~/darkmatter (with configurable remote name, bucket map, mount args, and DARKMATTER_BASE_DIR override).

Enables the R2 module by default in this repo’s flake.nix and updates the README to document the new R2 mount workflow (replacing the previous rclone-s3 docs). Separately, tweaks agenix-rekey workflow generation to prepend the “Generated by” header via runCommand rather than writeText.

^{Reviewed by Cursor Bugbot for commit 9fdaa06. Configure here.}

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{Bugbot Autofix is ON, but it could not run because the branch was deleted or merged before autofix could start.}

^{Reviewed by Cursor Bugbot for commit 9fdaa06. Configure here.}

[cursor]

Remote name regex matching instead of literal string

Low Severity

The grep -qx call treats remoteName as a basic regular expression rather than a fixed string. If remoteName contains regex metacharacters (e.g., a . in something like company.r2), the check could incorrectly match a different remote (like companyXr2:), causing the script to skip the helpful "remote not found" error and proceed to fail with a confusing rclone error. The mount-point checks on lines 133 and 166 correctly use grep -F for literal matching, but this remote-existence check does not.

 

^{Reviewed by Cursor Bugbot for commit 9fdaa06. Configure here.}