Restructure into a multi-machine flake and add the enzo laptop

Split the single-host config into a shared minimal base plus opt-in
profiles, and add a second machine (enzo laptop) alongside kusanagi.

- flake: add mkMachine helper; declare nixosConfigurations.kusanagi and
  .enzo; add the disko input; move overlays per-machine.
- common/: minimal base only (boot, networking, tailscale, locale, nix
  settings, neovim editor). Old configuration.nix/programs.nix removed.
- profiles/: coarse opt-in bundles (desktop, dev, apps). kusanagi imports
  all three and stays byte-for-byte identical to the running system.
- machines/kusanagi/: all workstation-only config (ROCm, Scarlett audio,
  optical-disc archiving, NAS mounts, kavita/immich/ollama); hardware
  config moved here unchanged. User stays 'henz'.
- machines/enzo/: new laptop. Declarative LUKS+btrfs via disko
  (LVM-on-LUKS, TPM2+PIN unlock, zram + encrypted swap for
  suspend-then-hibernate); its own minimal niri desktop with
  playback-only audio (no rtkit/jack); user 'hwebs'.

Assisted-by: Claude:claude-opus-4-8

1 files changed, 93 insertions, 0 deletions

diff --git a/machines/enzo/disko.nix b/machines/enzo/disko.nix
new file mode 100644
index 0000000..ddfa4d3
--- /dev/null
+++ b/machines/enzo/disko.nix
@@ -0,0 +1,93 @@
+# Declarative disk layout for enzo: LVM-on-LUKS with a btrfs root and an
+# encrypted swap logical volume (>= RAM) for hibernation.
+#
+#   nvme0n1
+#   ├─ p1  ESP   1 GiB  vfat  /boot            (unencrypted)
+#   └─ p2  LUKS2 "crypted"  ── LVM vg "vg" ──
+#           ├─ lv "swap"  swap  (hibernation target)
+#           └─ lv "root"  btrfs subvolumes: @ @home @nix @log @snapshots
+#
+# Apply on the laptop with (prompts for the LUKS passphrase = fallback keyslot):
+#   sudo nix run github:nix-community/disko/latest -- \
+#     --mode destroy,format,mount ./machines/enzo/disko.nix
+{ ... }:
+
+{
+  disko.devices = {
+    disk.main = {
+      type = "disk";
+      device = "/dev/nvme0n1"; # TODO: confirm on the laptop with `lsblk`
+      content = {
+        type = "gpt";
+        partitions = {
+          ESP = {
+            size = "1G";
+            type = "EF00";
+            content = {
+              type = "filesystem";
+              format = "vfat";
+              mountpoint = "/boot";
+              mountOptions = [ "umask=0077" ];
+            };
+          };
+          luks = {
+            size = "100%";
+            content = {
+              type = "luks";
+              name = "crypted";
+              settings = {
+                # Allow TRIM through LUKS (minor metadata leak, fine for a laptop SSD).
+                allowDiscards = true;
+              };
+              content = {
+                type = "lvm_pv";
+                vg = "vg";
+              };
+            };
+          };
+        };
+      };
+    };
+
+    lvm_vg.vg = {
+      type = "lvm_vg";
+      lvs = {
+        swap = {
+          size = "20G"; # TODO: set >= RAM (RAM + a little) for hibernation
+          content = {
+            type = "swap";
+            resumeDevice = true; # emits swapDevices + boot.resumeDevice
+          };
+        };
+        root = {
+          size = "100%FREE";
+          content = {
+            type = "btrfs";
+            extraArgs = [ "-f" ];
+            subvolumes = {
+              "@" = {
+                mountpoint = "/";
+                mountOptions = [ "compress=zstd" "noatime" ];
+              };
+              "@home" = {
+                mountpoint = "/home";
+                mountOptions = [ "compress=zstd" "noatime" ];
+              };
+              "@nix" = {
+                mountpoint = "/nix";
+                mountOptions = [ "compress=zstd" "noatime" ];
+              };
+              "@log" = {
+                mountpoint = "/var/log";
+                mountOptions = [ "compress=zstd" "noatime" ];
+              };
+              "@snapshots" = {
+                mountpoint = "/.snapshots";
+              };
+            };
+          };
+        };
+      };
+    };
+  };
+}