Feat/move to open source

.claude/commands/nix-add.md

@@ -0,0 +1,22 @@
+---
+description: Add a package, app, alias or env var to the right place in nix-config
+argument-hint: <package | app | alias | env var> [machine]
+allowed-tools: Bash(nix search:*), Bash(brew search:*), Bash(brew info:*)
+---
+
+Add `$ARGUMENTS` to this nix-darwin repo.
+
+1. Find it: `nix search nixpkgs <name>` for CLI tools; GUI apps go through Homebrew casks (`brew search --cask <name>`). Prefer nixpkgs for CLI tools, casks for GUI apps. If several matches, ask which one.
+2. Pick the file from README "Where to add things":
+   | What | Where |
+   |---|---|
+   | GUI app | `homebrew.casks` in `hosts/common/darwin/homebrew.nix` |
+   | CLI tool, system-wide | `environment.systemPackages` in `hosts/common/common-packages.nix` |
+   | CLI tool, personal | `home.packages` in `home-manager/profiles/base.nix` |
+   | Shell alias | `programs.zsh.shellAliases` in `home-manager/profiles/base.nix` |
+   | Env var | `home.sessionVariables` in `home-manager/profiles/base.nix` |
+   | One machine only | `hosts/darwin/<machine>/default.nix` or `home-manager/profiles/<machine>.nix` |
+   If a `home-manager/programs/<tool>.nix` module exists or the tool has a `programs.<tool>` home-manager option with config worth declaring, use that instead.
+3. Check it isn't already declared (grep the repo). Keep the list's existing order (alphabetical if it is).
+4. Secrets (tokens, keys, passwords) never go in `.nix` files: tell the user to add them with `nix run .#edit-secrets -- <machine>` and reference them through sops-nix.
+5. Run `/nix-check`.

.claude/commands/nix-check.md

@@ -0,0 +1,16 @@
+---
+description: Validate nix-config changes locally (mirrors CI) without switching
+allowed-tools: Bash(nix run .#scan-keys), Bash(nixfmt --check:*), Bash(nix flake check:*), Bash(nix build:*), Bash(git ls-files:*), Bash(git diff:*), Bash(scutil --get LocalHostName)
+---
+
+Validate the current working tree of this nix-darwin repo. Run each step, stop at the first failure, and report the real error output.
+
+0. Secrets: `nix run .#scan-keys`. This repo is public. On failure, list the file names only, never print or read the key/secret contents, and tell the user to remove the file and rotate the key if it was ever committed. Public keys (`*.pub`, age recipients in `.sops.yaml`) are fine.
+1. Format: `nixfmt --check` on changed/new `.nix` files only (`git ls-files -m -o --exclude-standard '*.nix'`). Some untouched files are not formatted yet; don't flag those.
+2. Eval: `nix flake check --no-build`
+3. Build current host: `nix build ".#darwinConfigurations.$(scutil --get LocalHostName).system" --no-link`
+   - If the change touches `hosts/common/`, `lib/`, `flake.nix`, `flake.lock` or `home-manager/profiles/base.nix`, also build the other host (`mac-pro` / `flow48`) — CI builds both.
+
+Never run `darwin-rebuild switch`, `nix run .#rebuild` or anything with `sudo`. On success, tell the user to apply with `nix run .#rebuild`.
+
+$ARGUMENTS

.claude/commands/nix-diff.md

@@ -0,0 +1,12 @@
+---
+description: Show what would change vs the running system before switching
+allowed-tools: Bash(nix build:*), Bash(nix store diff-closures:*), Bash(scutil --get LocalHostName)
+---
+
+1. Build the current host: `nix build ".#darwinConfigurations.$(scutil --get LocalHostName).system" --no-link --print-out-paths`
+2. Diff against the running system: `nix store diff-closures /run/current-system <out-path>`
+3. Summarize: version bumps, added/removed packages, notable size changes. Flag major version jumps and anything security-relevant. Skip noise (`-man`, `-doc`, unchanged-version rebuilds).
+
+Never switch. Tell the user to apply with `nix run .#rebuild` if it looks good.
+
+$ARGUMENTS

.github/workflows/check.yml

@@ -4,21 +4,27 @@ on:
   push:
     branches: [main]
   pull_request:
+  # update-flake.yml dispatches this: PRs opened with GITHUB_TOKEN don't trigger pull_request
+  workflow_dispatch:
+
+permissions:
+  contents: read
 
 jobs:
   flake-check:
     runs-on: macos-14
     steps:
-      - uses: actions/checkout@v5
-      - uses: DeterminateSystems/nix-installer-action@main
+      - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5.1.0
+      - uses: DeterminateSystems/nix-installer-action@3138316df39ed29be04236d7ffc686fa525866aa # v23
       - run: nix flake check --no-build
+      - run: nix run .#scan-keys
 
   build:
     runs-on: macos-14
     strategy:
       matrix:
         host: [mac-pro, flow48]
     steps:
-      - uses: actions/checkout@v5
-      - uses: DeterminateSystems/nix-installer-action@main
+      - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5.1.0
+      - uses: DeterminateSystems/nix-installer-action@3138316df39ed29be04236d7ffc686fa525866aa # v23
       - run: nix build ".#darwinConfigurations.${{ matrix.host }}.system" --no-link

.github/workflows/update-flake.yml

@@ -6,19 +6,27 @@ on:
   workflow_dispatch:
 
 permissions:
-  contents: write
-  pull-requests: write
+  contents: read
 
 jobs:
   update:
     runs-on: macos-14
+    permissions:
+      contents: write
+      pull-requests: write
+      actions: write # dispatch check.yml on the PR branch
     steps:
-      - uses: actions/checkout@v5
-      - uses: DeterminateSystems/nix-installer-action@main
+      - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5.1.0
+      - uses: DeterminateSystems/nix-installer-action@3138316df39ed29be04236d7ffc686fa525866aa # v23
       - run: nix flake update
-      - uses: peter-evans/create-pull-request@v7
+      - id: pr
+        uses: peter-evans/create-pull-request@22a9089034f40e5a961c8808d113e2c98fb63676 # v7.0.11
         with:
           title: "chore: update flake inputs"
           commit-message: "chore: update flake inputs"
           branch: update-flake-inputs
           delete-branch: true
+      - if: steps.pr.outputs.pull-request-operation == 'created' || steps.pr.outputs.pull-request-operation == 'updated'
+        run: gh workflow run check.yml --ref update-flake-inputs
+        env:
+          GH_TOKEN: ${{ github.token }}

.gitignore

@@ -3,5 +3,16 @@ result
 .idea
 secrets/**/*.yaml
 !secrets/**/*.enc.yaml
-.claude
+.claude/settings.local.json
 .DS_Store
+
+# private keys — never commit (public keys like *.pub / .sops.yaml recipients are fine)
+*.pem
+*.key
+id_rsa
+id_ed25519
+id_ecdsa
+keys.txt
+
+# backup_flashspace.sh local copies
+home-manager/programs/flashspace/backup_*.yaml

README.md

@@ -108,7 +108,7 @@ nix-config/
 ├── secrets/
 │   ├── <machine>/secrets.enc.yaml   # Encrypted machine secrets
 │   └── secrets_example.yaml         # Template
-└── templates/                       # Flake templates (node, esp32)
+└── templates/                       # Flake templates (node, esp32, api-rust)
 ```
 
 ---
@@ -226,7 +226,9 @@ cp secrets/secrets_example.yaml /tmp/secrets.yaml
 Edit `/tmp/secrets.yaml` — paste the contents of `~/.ssh/id_ed25519` as the `ssh_key` value.
 
 ```sh
-nix shell nixpkgs#sops --command sops --encrypt /tmp/secrets.yaml > secrets/<your-machine>/secrets.enc.yaml
+nix shell nixpkgs#sops --command sops --encrypt \
+  --filename-override secrets/<your-machine>/secrets.enc.yaml \
+  --output secrets/<your-machine>/secrets.enc.yaml /tmp/secrets.yaml
 rm /tmp/secrets.yaml   # never commit the unencrypted file
 ```
 
@@ -366,6 +368,7 @@ The `,` command is especially useful — e.g. `, ffmpeg -i video.mp4 output.gif`
 mkdir -p ~/Developer/my-app && cd ~/Developer/my-app
 tpl-node        # Node.js (pnpm, typescript)
 tpl-esp32       # ESP32-S3 Rust project
+tpl-api-rust    # Rust API (Diesel, PostgreSQL)
 direnv allow    # load dev environment
 ```
 
@@ -494,7 +497,9 @@ ssh_key: |
 
 Encrypt it:
 ```sh
-nix shell nixpkgs#sops --command sops --encrypt /tmp/secrets.yaml > secrets/<your-machine>/secrets.enc.yaml
+nix shell nixpkgs#sops --command sops --encrypt \
+  --filename-override secrets/<your-machine>/secrets.enc.yaml \
+  --output secrets/<your-machine>/secrets.enc.yaml /tmp/secrets.yaml
 rm /tmp/secrets.yaml
 ```