grub.enable defaults to true, so adding a boot.loader block silently
switched this host from the systemd-boot it was installed with over to
grub. nixos removes neither the old bootloader's files nor its nvram
entry, so both lived on the esp and the firmware kept booting a frozen
systemd-boot menu. pinning both options means a conflicting definition
elsewhere now fails loudly instead of quietly winning. note the pins
delete nothing - stale EFI/systemd/, loader/ and the leftover nvram entry
still have to be cleared by hand. done on shadow, not verified on t480.
configurationLimit bounds esp usage for real, not just the menu:
install-grub.pl unlinks any $boot/kernels/* that no kept generation
references. sizing measured on shadow rather than assumed - 10 kept
generations referenced 1 bzImage and 3 initrds for 114mib total, about
11mib per generation, because generations share aggressively. the
worst case is higher, around 47mib each, since nixpkgs embeds
/etc/modprobe.d/nixos.conf inside the initrd and so every kernel module
parameter edit mints a fresh one. 10 therefore costs ~115mib typically
and ~470mib worst case against a 1gib esp that also carries the grub
modules, the catppuccin theme, and windows' own boot files.
keeping it conservative matters because overflow fails as `copy ... or
die` in install-grub.pl, which runs *after* the system profile has
already been switched - the result is an activated but unbootable
generation. t480 reaches this module too and its esp may be smaller.
result is a symlink into /nix/store that nix build rewrites on every
invocation, so tracking it churns the history and pins a store path that
means nothing on any other machine. it was committed pointing at a t480
system while sitting on shadow.
the two git-secret lines are what `git secret init` writes. worth being
explicit about what they do and do not cover: `!*.secret` un-ignores the
*encrypted* blobs only. nothing here protects the plaintext originals -
that relies entirely on `git secret add` appending each plaintext path to
this file, so always run it from the repo root rather than hand-editing
.gitsecret/paths/mapping.cfg.
.gitsecret/keys is git-secret's gpg homedir. pubring.kbx is meant to be
committed, but a stray `gpg --homedir .gitsecret/keys --import` of a
private key would drop private-keys-v1.d/ in there, so those paths are
ignored up front rather than after the fact.
sdb (GAMES) is an ssd - samsung 870 qvo, rotational=0 - so unlike the two wd
spinners there is no spin-down to gain from automounting it, and a steam library
is better off never sitting behind a trigger. keeps nofail. dump and bak stay
lazy.
splits the old dataDrive helper into spinningDrive and eagerDrive and documents
why each drive gets which.
also records the steam gotcha found while debugging "steam library folder not
writable": it was never a permissions problem - the drives are owned by uid 1000
mode 755 and were writable throughout. steam's fhs sandbox builds its bind list
at launch by iterating /*, and /mnt does not exist on nixos until these
fileSystems entries are activated, so a steam started before that has no /mnt
for its entire lifetime. restarting steam is the fix.
importing /etc/nixos/hardware-configuration.nix by absolute path from the
shared core module had two problems: it made the flake impure (every eval
needed --impure, since the file lives outside the store) and both hosts
resolved to whichever machine's file was on disk, so evaluating t480 on shadow
silently baked in shadow's disk uuids.
shadow now carries its own generated scan at modules/hosts/shadow/_hardware.nix.
the leading underscore keeps import-tree from picking it up as a flake-parts
module - its filter drops any path containing "/_" - so it is imported
explicitly from the host's default.nix.
it is generated with --no-filesystems and all of shadow's filesystems are
declared by hand in disks.nix instead. that split is what makes regeneration
safe: nixos-generate-config emits fileSystems for whatever is mounted at the
time, which would otherwise conflict with the entries below every time the data
drives happened to be mounted. `nix run .#sync-hardware` refreshes the file.
DUMP/GAMES/BAK are mounted by label at /mnt/{dump,games,bak} with
noauto + x-systemd.automount, so the two 2.7T spinners stay parked until
something touches the path and spin back down after 10 minutes idle. nofail
keeps a missing disk from dropping the boot into emergency mode.
/ and /boot are unchanged - still the same uuids, verified identical to the
previous evaluation. t480 keeps the absolute import for now with a TODO; its
scan can only be generated on the machine itself.
udiskie was installed but never actually launched - nothing in the dotfiles autostarts it, and services.udisks2 was off, so even once started it had no daemon to talk to. binds it to graphical-session.target (managed by uwsm) so it starts and stops with the session. only touches removable media: udisks2 reports the internal sata disks as HintSystem=true, so the drives declared in disks.nix are left alone.
the xorg package set is deprecated in nixpkgs 26.05. pkgs.xrandr resolves to the same xrandr-1.5.4 derivation, so hyprland autostart scripts calling xrandr are unaffected.
adds security.sudo.extraRules with NOPASSWD: ALL. the rule is emitted after the default %wheel SETENV rule and sudoers is last-match-wins, so it takes precedence. lives in the shared user module, so it applies to both shadow and t480.
moves user identity and init.defaultBranch into /etc/gitconfig instead of stow-managed dotfiles. note: a per-user ~/.gitconfig still overrides these, so identity must stay out of the stow repo to avoid shadowing.
ahmza