diff options
Diffstat (limited to 'nix/common.nix')
| -rw-r--r-- | nix/common.nix | 104 |
1 files changed, 25 insertions, 79 deletions
diff --git a/nix/common.nix b/nix/common.nix index 7290395..c256aa2 100644 --- a/nix/common.nix +++ b/nix/common.nix @@ -1,31 +1,12 @@ -{ config, pkgs, lib, dotfilesRoot, ... }: +{ + config, + pkgs, + lib, + dotfilesRoot, + ... +}: -# Shared Home-Manager module: ONLY package installation. Dotfile deployment is -# owned by chezmoi on both the Arch host and the remote-dev VM. Keeping this -# module deployment-agnostic prevents home-manager from conflicting with -# chezmoi-owned files (which would otherwise materialize as `.backup` files on -# every `nix-switch`). -# -# Policy: this profile carries leaf CLI tools, editor/AI-agent runtimes -# (node, uv), and build *orchestrators* (cmake, ninja, ccache, sccache). -# It must NEVER carry actual compilers or linkers — those would shadow -# the system's and silently link projects against nixpkgs glibc/libstdc++ -# instead of the system sysroot. -# -# Forbidden on PATH from this module: cc, c++, gcc, g++, clang, clang++, -# ld, ld.lld, ar, nm, objcopy, make, meson, pkg-config, autoconf, -# automake, libtool, python, python3, pip, cargo, rustc, go. -# -# Allowed: orchestrators that delegate to whatever compiler is in PATH -# (cmake, ninja, ccache, sccache), instrumentation/analysis that hooks -# at the syscall/library boundary (valgrind, gdb, lldb, strace), and -# source-only tooling (doxygen, clang-tools — clangd/clang-format/ -# clang-tidy, no compiler driver). Project-specific compilers/linkers -# go in project-local flake.nix + direnv `.envrc`, NOT here. -# -# Editor/AI runtimes: node, npm, npx (via `nodejs`), uv, uvx (via `uv` -# — manages its own python interpreters under XDG, doesn't install a -# system python3). +# Shared Home-Manager package profile. Chezmoi owns dotfile deployment. { home.stateVersion = "25.05"; @@ -53,8 +34,6 @@ glow # Git stack - # Includes git-send-email: nixpkgs wraps it with the SMTP/SASL Perl deps - # it needs, so we don't carry distro Perl modules just for email support. (git.override { sendEmailSupport = true; }) gh delta @@ -94,19 +73,15 @@ openssh mosh - # Debug / trace / profile — moved off pacman. User policy: only - # used against own builds, so glibc/kernel version skew vs the - # system isn't an issue. Only `perf` stays system (it links against - # the running kernel ABI; pacman's matches the kernel package). + # Debug / trace / profile gdb - lldb # also brings lldb-dap (used by dap.lua via type="lldb") + lldb # also brings lldb-dap (used by dap.lua via type="lldb") strace samply t-rec valgrind - # Build orchestrators — these only delegate to whatever compiler is - # in PATH; they don't ship cc/c++/ld themselves, so no shadowing. + # Build orchestrators cmake ninja ccache @@ -123,19 +98,12 @@ pandoc # Secrets — `pass-otp` is wired as an extension so `pass otp ...` - # works against the same store. `pass` from pacman is removed. + # works against the same store. gnupg pinentry-curses (pass.withExtensions (exts: [ exts.pass-otp ])) - # C/C++ source tooling (no compiler driver in PATH). - # clang-tools ships clangd/clang-format/clang-tidy and most of the - # python helpers (git-clang-format, clang-format-diff, clang-tidy-diff) - # but skips run-clang-tidy because the symlink loop in nixpkgs' - # clang-tools derivation gates on the +x bit and run-clang-tidy - # loses it during the multi-output split. Re-expose it ourselves - # from clang-unwrapped's `python` output (tries both the modern - # bin/ layout and the legacy share/clang/ layout). + # C/C++ source tooling clang-tools (runCommand "run-clang-tidy" { } '' mkdir -p $out/bin @@ -151,49 +119,33 @@ exit 1 '') - # CI runner (drives podman; act itself is just a Go binary) + # CI runner act # ── Rootless podman ───────────────────────────────────────────────────── - # Moved off pacman so the host and VM run the same nix-pinned stack. - # The nix `podman` is wrapped to find these helpers via /nix/store - # paths, so we don't need a containers.conf for `helper_binaries_dir`. - # Per-user containers config (registries/storage/policy) lives under - # chezmoi at `dot_config/containers/`. podman - crun # OCI runtime (lighter than runc; default for rootless) - conmon # container monitor process - netavark # default network stack on podman 4+ + crun # OCI runtime (lighter than runc; default for rootless) + conmon # container monitor process + netavark # default network stack on podman 4+ aardvark-dns # DNS for netavark networks - slirp4netns # rootless user-mode networking - passt # pasta backend (slirp4netns successor; podman picks it up) + slirp4netns # rootless user-mode networking + passt # pasta backend (slirp4netns successor; podman picks it up) podman-compose - # `docker` shell shim → podman. nixpkgs has no top-level - # `podman-docker` attr (Arch ships one as a convenience pkg); the - # NixOS option `virtualisation.podman.dockerCompat` exists but isn't - # reachable from home-manager, so we ship a one-line writer instead. + # `docker` shell shim → podman. (writeShellScriptBin "docker" ''exec ${podman}/bin/podman "$@"'') - # Editor/AI agent runtimes — NOT for project builds (see policy above) + # Editor/AI agent runtimes nodejs_24 # copilot-language-server requires Node 24 (see ai.lua) - uv # for project tooling that asks for `uv`/`uvx`; brings no python + uv # for project tooling that asks for `uv`/`uvx`; brings no python python3Packages.ipython # interactive REPL; pulls its own python, only `ipython` lands on PATH # AI coding agents claude-code - codex # OpenAI Codex CLI (rust rewrite); replaces pacman openai-codex-bin + codex # OpenAI Codex CLI github-copilot-cli # `copilot`; prebuilt-binary derivation since 1.0.43 tuicr # interactive git-change reviewer; flake input, see nix/flake.nix. Skill: dot_claude/skills/tuicr/ # ── LSPs / formatters / linters / DAPs ───────────────────────────────── - # Replaces Mason entirely (phase p6 of the nix migration rips out - # mason-tool-installer). The set tracks the previous - # `ensure_installed` list in dot_config/nvim/lua/plugins/lsp.lua, with - # five niche tools dropped: groovy-language-server (Mason-only build, - # upstream stale), npm-groovy-lint, nginx-language-server, - # nginx-config-formatter, systemdlint (all rarely-edited domains; - # losing them is acceptable). - # LSPs actionlint autotools-language-server @@ -208,7 +160,7 @@ systemd-language-server taplo typescript-language-server - vscode-langservers-extracted # cssls + html + jsonls + eslint + vscode-langservers-extracted # cssls + html + jsonls + eslint yaml-language-server # Formatters @@ -228,13 +180,7 @@ typos yamllint - # DAPs / debuggers — `lldb-dap` ships in pkgs.lldb (declared in the - # debug/trace block above). dap configs in plugins/debug.lua target - # it via `type = "lldb"`. - - # Zsh and plugins (loaded from $HOME/.nix-profile/share/... by the - # shared zshrc; nix-profile path is preferred, system path is the - # fallback for un-bootstrapped states). + # Zsh and plugins zsh zsh-completions zsh-syntax-highlighting |