feat(bootstrap): install nix + Home-Manager on Arch host (p8)

Append two steps to the root bootstrap.sh:

  5a. install nix via the Determinate Systems multi-user installer
      (same as remote-dev/nix; gives us a proper nix-daemon.service).
  5b. chsh to ~/.nix-profile/bin/zsh after appending to /etc/shells.

Add a 'just nix-switch' recipe that auto-picks the host vs vm profile
based on /etc/os-release ID, and wire it into 'just init' and
'just sync' so day-to-day reconciliation also re-applies Home-Manager.

The recipe is a no-op when nix isn't installed, so it stays safe for
pre-bootstrap states and for hosts where the user opts out.

Phase 8 of the nix-on-host migration plan.

2 files changed, 55 insertions, 4 deletions

diff --git a/bootstrap.sh b/bootstrap.sh
index 2e5721d..1d3783b 100755
--- a/bootstrap.sh
+++ b/bootstrap.sh
@@ -73,10 +73,42 @@ fi
 #    git hooks. The classic 'sudo' package stays installed because
 #    base-devel hard-depends on it; that's harmless — the binary is
 #    never invoked once /usr/local/bin/sudo is in place.
+#    `just init` also runs `just nix-switch` (step 5b below); the nix
+#    install needs to happen before that.
 cd "$DOTFILES_DIR"
+
+# 5a. install nix (Determinate Systems installer, multi-user) before
+#     `just init`, so `just nix-switch` finds it.
+if ! command -v nix >/dev/null 2>&1; then
+  log 'installing nix (Determinate Systems multi-user installer)'
+  curl --proto '=https' --tlsv1.2 -sSf -L \
+    https://install.determinate.systems/nix |
+    sh -s -- install linux --no-confirm
+  # Source nix env for the rest of this script (installer writes
+  # /etc/profile.d/nix.sh but the current shell hasn't sourced it).
+  if [ -f /nix/var/nix/profiles/default/etc/profile.d/nix-daemon.sh ]; then
+    # shellcheck disable=SC1091
+    . /nix/var/nix/profiles/default/etc/profile.d/nix-daemon.sh
+  fi
+fi
+
 log 'running just init'
 just init
 
+# 5b. chsh to nix-store zsh (provisioned by home-manager via nix/common.nix)
+NIX_ZSH="$HOME/.nix-profile/bin/zsh"
+if [ -x "$NIX_ZSH" ]; then
+  if ! grep -qxF "$NIX_ZSH" /etc/shells 2>/dev/null; then
+    log "appending $NIX_ZSH to /etc/shells"
+    echo "$NIX_ZSH" | sudo tee -a /etc/shells >/dev/null
+  fi
+  current_shell="$(getent passwd "$USER" | cut -d: -f7)"
+  if [ "$current_shell" != "$NIX_ZSH" ]; then
+    log "changing login shell to $NIX_ZSH"
+    sudo chsh -s "$NIX_ZSH" "$USER"
+  fi
+fi
+
 # 6. refresh pacman mirrorlist once via reflector (config deployed by chezmoi)
 log 'refreshing pacman mirrorlist via reflector'
 sudo reflector @/etc/xdg/reflector/reflector.conf \
diff --git a/justfile b/justfile
index 8cb4dc6..fa80823 100644
--- a/justfile
+++ b/justfile
@@ -6,20 +6,39 @@ default:
 # Setup
 # ═══════════════════════════════════════════════════════════════════
 
-# First-time machine setup: regenerate chezmoi config, install git hooks, deploy dotfiles, install base packages, enable curated units
-init: _chezmoi-init _install-hooks apply (pkg-apply "base") unit-apply
+# First-time machine setup: regenerate chezmoi config, install git hooks, deploy dotfiles, install base packages, enable curated units, switch Home-Manager
+init: _chezmoi-init _install-hooks apply (pkg-apply "base") unit-apply nix-switch
 
 # ═══════════════════════════════════════════════════════════════════
 # Day-to-day
 # ═══════════════════════════════════════════════════════════════════
 
-# Reconcile everything: deploy dotfiles + /etc, top up packages, enable curated units
-sync: apply pkg-fix unit-apply
+# Reconcile everything: deploy dotfiles + /etc, top up packages, enable curated units, sync Home-Manager
+sync: apply pkg-fix unit-apply nix-switch
 
 # Deploy dotfiles AND /etc atomically (chezmoi apply; /etc handled by onchange template)
 apply:
     chezmoi apply -S . -v
 
+# Apply Home-Manager profile (host on Arch, vm on Ubuntu remote-dev). Falls
+
+# back to a no-op when nix isn't installed (pre-bootstrap state).
+nix-switch:
+    #!/bin/sh
+    set -eu
+    if ! command -v nix >/dev/null 2>&1; then
+        echo "nix not installed; skipping home-manager switch" >&2
+        exit 0
+    fi
+    profile=host
+    [ -f /etc/os-release ] && . /etc/os-release || true
+    case "${ID:-}" in
+        ubuntu|debian) profile=vm ;;
+    esac
+    nix --extra-experimental-features 'nix-command flakes' \
+        run home-manager/master -- \
+        switch --impure --flake "{{ justfile_directory() }}/nix#${profile}" -b backup
+
 # ═══════════════════════════════════════════════════════════════════
 # Updates
 # ═══════════════════════════════════════════════════════════════════