Add the Canonical laptop profile and setup workflows

15 files changed, 89 insertions, 12 deletions

diff --git a/dot_config/autostart/dotfiles-keybase.desktop b/dot_config/autostart/dotfiles-keybase.desktop
new file mode 100644
index 0000000..fbc6b9d
--- /dev/null
+++ b/dot_config/autostart/dotfiles-keybase.desktop
@@ -0,0 +1,5 @@
+[Desktop Entry]
+Type=Application
+Name=Keybase
+Exec=env KEYBASE_AUTOSTART=1 /snap/bin/keybase
+OnlyShowIn=GNOME;
diff --git a/dot_config/autostart/dotfiles-mattermost.desktop b/dot_config/autostart/dotfiles-mattermost.desktop
new file mode 100644
index 0000000..aa309dd
--- /dev/null
+++ b/dot_config/autostart/dotfiles-mattermost.desktop
@@ -0,0 +1,5 @@
+[Desktop Entry]
+Type=Application
+Name=Mattermost
+Exec=/snap/bin/mattermost-desktop --hidden
+OnlyShowIn=GNOME;
diff --git a/dot_config/autostart/dotfiles-nheko.desktop b/dot_config/autostart/dotfiles-nheko.desktop
new file mode 100644
index 0000000..d71f16e
--- /dev/null
+++ b/dot_config/autostart/dotfiles-nheko.desktop
@@ -0,0 +1,5 @@
+[Desktop Entry]
+Type=Application
+Name=Nheko Work
+Exec=/usr/bin/flatpak run im.nheko.Nheko --profile work
+OnlyShowIn=GNOME;
diff --git a/dot_config/autostart/dotfiles-thunderbird.desktop b/dot_config/autostart/dotfiles-thunderbird.desktop
new file mode 100644
index 0000000..ced3696
--- /dev/null
+++ b/dot_config/autostart/dotfiles-thunderbird.desktop
@@ -0,0 +1,5 @@
+[Desktop Entry]
+Type=Application
+Name=Thunderbird
+Exec=/snap/bin/thunderbird
+OnlyShowIn=GNOME;
diff --git a/dot_config/containers/storage.conf.tmpl b/dot_config/containers/storage.conf.tmpl
index c304b02..a148c5e 100644
--- a/dot_config/containers/storage.conf.tmpl
+++ b/dot_config/containers/storage.conf.tmpl
@@ -1,5 +1,5 @@
 {{- $machineRole := default "host" (index . "machineRole") -}}
-{{- if eq $machineRole "vm" -}}
+{{- if ne $machineRole "host" -}}
 # Rootless podman storage configuration: VM ext4.
 
 [storage]
diff --git a/dot_config/dotfiles/role.tmpl b/dot_config/dotfiles/role.tmpl
new file mode 100644
index 0000000..f889c28
--- /dev/null
+++ b/dot_config/dotfiles/role.tmpl
@@ -0,0 +1 @@
+{{ default "host" (index . "machineRole") }}
diff --git a/dot_config/ghostty/config b/dot_config/ghostty/config.tmpl
index 8a1faf6..605c6d1 100644
--- a/dot_config/ghostty/config
+++ b/dot_config/ghostty/config.tmpl
@@ -13,7 +13,12 @@ clipboard-read = allow
 bell-features = attention,title
 
 # Window — no decorations (sway manages windows)
+{{ if eq (default "host" (index . "machineRole")) "canonical" }}
+window-decoration = auto
+command = {{ .chezmoi.homeDir }}/.nix-profile/bin/zsh -l
+{{ else }}
 window-decoration = none
+{{ end }}
 confirm-close-surface = false
 resize-overlay = never
 
diff --git a/dot_config/git/config b/dot_config/git/config.tmpl
index 4237892..9987261 100644
--- a/dot_config/git/config
+++ b/dot_config/git/config.tmpl
@@ -1,7 +1,13 @@
 [user]
+{{ if eq (default "host" (index . "machineRole")) "canonical" }}
+    email = {{ .workEmail | quote }}
+    name = {{ .workName | quote }}
+    signingkey = {{ .workSigningKey | quote }}
+{{ else }}
     email = sommerfeld@sommerfeld.dev
     name = sommerfeld
     signingkey = 3298945F717C85F8
+{{ end }}
 [push]
     autoSetupRemote = true
     followTags = true
@@ -9,8 +15,10 @@
 [core]
     whitespace = trailing-space,cr-at-eol
     pager = delta
+{{ if ne (default "host" (index . "machineRole")) "canonical" }}
     hooksPath = ~/.config/git/hooks
     sshCommand = "ssh -i ~/.ssh/nym.pub"
+{{ end }}
 [branch]
     sort=-committerdate
 [diff]
@@ -129,6 +137,7 @@
     swd = switch -d
     unstage = reset HEAD --
     update=!git fetch && git merge --ff-only
+{{ if ne (default "host" (index . "machineRole")) "canonical" }}
 [includeIf "gitdir:~/doxfiles/.git"]
     path = config-personal
 [includeIf "gitdir:~/dev/personal/"]
@@ -149,6 +158,7 @@
     assume8bitEncoding = UTF-8
 [credential "smtp://127.0.0.1:1016"]
     helper = "!f() { test \"$1\" = get && printf 'password=%s\\n' \"$(pass show proton/bridge-smtp)\"; }; f"
+{{ end }}
 [include]
     ; Machine-local overrides. Git silently skips this if the file is absent.
     path = ~/.config/git/config.local
diff --git a/dot_config/mimeapps.list b/dot_config/mimeapps.list.tmpl
index ab2f7e2..f5b6d20 100644
--- a/dot_config/mimeapps.list
+++ b/dot_config/mimeapps.list.tmpl
@@ -1,3 +1,16 @@
+{{ if eq (default "host" (index . "machineRole")) "canonical" }}
+[Default Applications]
+application/pdf=org.pwmt.zathura.desktop
+x-scheme-handler/http=firefox_firefox.desktop
+x-scheme-handler/https=firefox_firefox.desktop
+text/html=firefox_firefox.desktop
+x-scheme-handler/mailto=thunderbird_thunderbird.desktop
+x-scheme-handler/webcal=thunderbird_thunderbird.desktop
+message/rfc822=thunderbird_thunderbird.desktop
+
+[Removed Associations]
+application/pdf=org.pwmt.zathura-pdf-poppler.desktop;
+{{ else }}
 [Default Applications]
 audio/x-vorbis+ogg=io.mpv.Mpv.desktop
 audio/aac=io.mpv.Mpv.desktop
@@ -115,3 +128,4 @@ x-scheme-handler/webcals=org.mozilla.thunderbird.desktop;
 [Removed Associations]
 application/pdf=org.pwmt.zathura-pdf-poppler.desktop;
 application/postscript=org.pwmt.zathura-ps.desktop;
+{{ end }}
diff --git a/dot_config/nix/nix.conf b/dot_config/nix/nix.conf
new file mode 100644
index 0000000..16e17dd
--- /dev/null
+++ b/dot_config/nix/nix.conf
@@ -0,0 +1,2 @@
+experimental-features = nix-command flakes
+!include nix.local.conf
diff --git a/dot_config/systemd/user/gpg-agent.service.d/canonical.conf.tmpl b/dot_config/systemd/user/gpg-agent.service.d/canonical.conf.tmpl
new file mode 100644
index 0000000..34557b4
--- /dev/null
+++ b/dot_config/systemd/user/gpg-agent.service.d/canonical.conf.tmpl
@@ -0,0 +1,3 @@
+[Service]
+ExecStart=
+ExecStart="{{ .chezmoi.homeDir }}/.nix-profile/bin/gpg-agent" --supervised
diff --git a/dot_config/systemd/user/podman.service.tmpl b/dot_config/systemd/user/podman.service.tmpl
new file mode 100644
index 0000000..f104bd9
--- /dev/null
+++ b/dot_config/systemd/user/podman.service.tmpl
@@ -0,0 +1,9 @@
+[Unit]
+Description=Rootless Podman API
+Requires=podman.socket
+After=podman.socket
+
+[Service]
+Type=exec
+ExecStart="{{ .chezmoi.homeDir }}/.nix-profile/bin/podman" system service
+KillMode=process
diff --git a/dot_config/systemd/user/podman.socket b/dot_config/systemd/user/podman.socket
new file mode 100644
index 0000000..9d17f3b
--- /dev/null
+++ b/dot_config/systemd/user/podman.socket
@@ -0,0 +1,9 @@
+[Unit]
+Description=Rootless Podman API socket
+
+[Socket]
+ListenStream=%t/podman/podman.sock
+SocketMode=0600
+
+[Install]
+WantedBy=sockets.target
diff --git a/dot_config/zsh/dot_zprofile b/dot_config/zsh/dot_zprofile
index a2f5c8b..ab6badb 100644
--- a/dot_config/zsh/dot_zprofile
+++ b/dot_config/zsh/dot_zprofile
@@ -4,6 +4,8 @@
 # Guard against double-sourcing (e.g. nested login shells)
 [[ -n $__ZPROFILE_SOURCED ]] && return
 __ZPROFILE_SOURCED=1
+_dotfiles_role=host
+[[ -r "$HOME/.config/dotfiles/role" ]] && _dotfiles_role=$(<"$HOME/.config/dotfiles/role")
 
 # ── PATH ──────────────────────────────────────────────────────────────────────
 typeset -U path  # deduplicate PATH entries
@@ -104,13 +106,15 @@ export _JAVA_OPTIONS="-Dawt.useSystemAAFontSettings=on -Dswing.aatext=true -Dswi
 export _JAVA_AWT_WM_NONREPARENTING=1
 
 # ── Miscellaneous ─────────────────────────────────────────────────────────────
-export QT_QPA_PLATFORMTHEME=qt6ct
-export NO_AT_BRIDGE=1          # suppress GTK accessibility bus warnings
+if [[ $_dotfiles_role == host ]]; then
+    export QT_QPA_PLATFORMTHEME=qt6ct
+    export NO_AT_BRIDGE=1
+fi
 export DOCKER_HOST="unix://$XDG_RUNTIME_DIR/podman/podman.sock"
 export INPUTRC="$XDG_CONFIG_HOME/sh/inputrc"
 
 # ── Wayland ───────────────────────────────────────────────────────────────────
-export XDG_CURRENT_DESKTOP=sway
+[[ $_dotfiles_role == host ]] && export XDG_CURRENT_DESKTOP=sway
 # Prefer Wayland for Qt; fall back to xcb for apps without qt{5,6}-wayland.
 export QT_QPA_PLATFORM="wayland;xcb"
 # SDL2 defaults to X11; force Wayland with X11 fallback. SDL3 ignores this.
@@ -142,7 +146,7 @@ case $(uname -n) in
 esac
 
 # ── Auto-start sway on VT1 ────────────────────────────────────────────────────
-if [[ -z $WAYLAND_DISPLAY && $XDG_VTNR == 1 ]]; then
+if [[ $_dotfiles_role == host && -z $WAYLAND_DISPLAY && $XDG_VTNR == 1 ]]; then
     export XDG_SESSION_TYPE=wayland
     exec sway
 fi
diff --git a/dot_config/zsh/dot_zshrc b/dot_config/zsh/dot_zshrc
index 8371c15..dc92c3c 100644
--- a/dot_config/zsh/dot_zshrc
+++ b/dot_config/zsh/dot_zshrc
@@ -385,8 +385,10 @@ za() {
 # (e.g. attached over SSH, then reattached locally, or vice versa).
 reload-env() {
 	local pid
-	pid=$(pgrep -u "$UID" -x sway | head -1) || {
-		echo "reload-env: no sway process found for $USER" >&2
+	local compositor=sway
+	[[ $(<"$HOME/.config/dotfiles/role") == canonical ]] && compositor=gnome-shell
+	pid=$(pgrep -u "$UID" -x "$compositor" | head -1) || {
+		echo "reload-env: no $compositor process found for $USER" >&2
 		return 1
 	}
 	local kv
@@ -409,11 +411,9 @@ alias rj='just --justfile ~/.local/share/dotfiles/nix/justfile --working-directo
 
 # Home-Manager (flake-based; standalone HM defaults to legacy ~/.config/home-manager)
 hm() {
-    local profile=host
-    [ -r /etc/os-release ] && . /etc/os-release
-    case "${ID:-}" in
-        ubuntu|debian) profile=vm ;;
-    esac
+    local profile
+    profile=$(chezmoi data | jq -er '.machineRole') || return
+    case $profile in host|vm|canonical) ;; *) return 1 ;; esac
     local flake="$HOME/dotfiles/nix#${profile}"
     [ -d "$HOME/.local/share/dotfiles/nix" ] && flake="$HOME/.local/share/dotfiles/nix#${profile}"
     nix run home-manager/master -- "$@" --flake "$flake" --impure