Restructure into a multi-machine flake and add the enzo laptop

Split the single-host config into a shared minimal base plus opt-in
profiles, and add a second machine (enzo laptop) alongside kusanagi.

- flake: add mkMachine helper; declare nixosConfigurations.kusanagi and
  .enzo; add the disko input; move overlays per-machine.
- common/: minimal base only (boot, networking, tailscale, locale, nix
  settings, neovim editor). Old configuration.nix/programs.nix removed.
- profiles/: coarse opt-in bundles (desktop, dev, apps). kusanagi imports
  all three and stays byte-for-byte identical to the running system.
- machines/kusanagi/: all workstation-only config (ROCm, Scarlett audio,
  optical-disc archiving, NAS mounts, kavita/immich/ollama); hardware
  config moved here unchanged. User stays 'henz'.
- machines/enzo/: new laptop. Declarative LUKS+btrfs via disko
  (LVM-on-LUKS, TPM2+PIN unlock, zram + encrypted swap for
  suspend-then-hibernate); its own minimal niri desktop with
  playback-only audio (no rtkit/jack); user 'hwebs'.

Assisted-by: Claude:claude-opus-4-8

6 files changed, 635 insertions, 0 deletions

diff --git a/machines/enzo/default.nix b/machines/enzo/default.nix
new file mode 100644
index 0000000..65adef6
--- /dev/null
+++ b/machines/enzo/default.nix
@@ -0,0 +1,91 @@
+# enzo — laptop. Gets the shared common/ base plus laptop-only settings.
+{ inputs, pkgs, ... }:
+
+{
+  imports = [
+    # enzo's own minimal desktop (not the shared profiles/desktop.nix). Add
+    # ../../profiles/dev.nix or apps.nix here, or one-off packages below, as needed.
+    ./desktop.nix
+
+    inputs.disko.nixosModules.disko
+    ./disko.nix
+    ./hardware-configuration.nix
+  ];
+
+  networking.hostName = "enzo";
+
+  # Set this to the NixOS release the laptop is first installed from, then
+  # leave it. (See the comment in machines/kusanagi/default.nix.)
+  system.stateVersion = "26.05";
+
+  # --- User account (hwebs) ---
+  # (Desktop groups audio/input come from ./desktop.nix.)
+  users.users.hwebs = {
+    isNormalUser = true;
+    description = "Henry Webster";
+    extraGroups = [
+      "networkmanager"
+      "wheel"
+    ];
+    packages = with pkgs; [
+      git
+      neovim
+      tmux
+      btop
+      ripgrep
+      unzip
+      xclip
+      bc
+      psmisc
+      usbutils
+      stow
+      nushell
+    ];
+  };
+
+  nix.settings.trusted-users = [
+    "root"
+    "hwebs"
+  ];
+
+  # --- Disk encryption / hibernation / swap ---
+  # systemd in initrd is required for TPM2 unlock and clean hibernate resume.
+  boot.initrd.systemd.enable = true;
+
+  # TPM2 auto-unlock. Enroll the key WITH A PIN post-install:
+  #   sudo systemd-cryptenroll --tpm2-device=auto --tpm2-pcrs=7 \
+  #     --tpm2-with-pin=yes /dev/nvme0n1p2
+  # The original LUKS passphrase stays as a fallback keyslot. disko already
+  # declares boot.initrd.luks.devices."crypted".device.
+  boot.initrd.luks.devices."crypted".crypttabExtraOpts = [ "tpm2-device=auto" ];
+
+  # zram for everyday paging; the encrypted LVM swap from disko.nix is the
+  # hibernation target (boot.resumeDevice comes from disko's resumeDevice=true).
+  zramSwap.enable = true;
+
+  # Suspend-to-RAM on lid close, auto-hibernate after a delay so a dying battery
+  # doesn't lose the session. Everyday resume needs only the login password; the
+  # LUKS PIN appears only on cold boot / hibernate resume.
+  services.logind.settings.Login.HandleLidSwitch = "suspend-then-hibernate";
+  systemd.sleep.settings.Sleep.HibernateDelaySec = "60min";
+
+  # btrfs + SSD upkeep.
+  services.btrfs.autoScrub.enable = true;
+  services.fstrim.enable = true;
+
+  # --- Laptop power management ---
+  # power-profiles-daemon integrates with GNOME's power settings. If you prefer
+  # finer-grained control, disable this and enable services.tlp instead.
+  services.power-profiles-daemon.enable = true;
+  powerManagement.enable = true;
+
+  # Backlight control from the CLI / keybinds (programs.light was removed from
+  # nixpkgs; acpilight provides the udev rules and brightnessctl the CLI).
+  hardware.acpilight.enable = true;
+  environment.systemPackages = [ pkgs.brightnessctl ];
+
+  # --- GPU ---
+  # TODO: adjust for the laptop's actual GPU once known. For an Intel iGPU add
+  # intel-media-driver to hardware.graphics.extraPackages; for a discrete AMD
+  # GPU you may want ROCm as in machines/kusanagi/default.nix.
+}
diff --git a/machines/enzo/desktop.nix b/machines/enzo/desktop.nix
new file mode 100644
index 0000000..8fb68ef
--- /dev/null
+++ b/machines/enzo/desktop.nix
@@ -0,0 +1,68 @@
+# Minimal niri desktop for enzo — deliberately separate from ../../profiles/desktop.nix
+# so the laptop can grow on its own terms. Add to it (or switch to the shared
+# profile) whenever you want more.
+{ pkgs, ... }:
+
+{
+  # --- Session / login ---
+  programs.niri.enable = true;
+  programs.dconf.enable = true;
+
+  services.greetd = {
+    enable = true;
+    settings.default_session = {
+      command = "${pkgs.tuigreet}/bin/tuigreet --time --remember --cmd niri-session";
+      user = "greeter";
+    };
+  };
+  # Let tuigreet write its cache (for --remember).
+  systemd.services.greetd.serviceConfig = {
+    Type = "idle";
+    StandardInput = "tty";
+    StandardOutput = "tty";
+    StandardError = "journal";
+    TTYReset = true;
+    TTYVHangup = true;
+    TTYVTDisallocate = true;
+  };
+
+  # --- Graphics ---
+  hardware.graphics.enable = true;
+
+  # --- Audio (playback only; no rtkit/jack — enzo isn't for recording).
+  # If you ever hear dropouts under load, add: security.rtkit.enable = true;
+  services.pulseaudio.enable = false;
+  services.pipewire = {
+    enable = true;
+    alsa.enable = true;
+    pulse.enable = true;
+  };
+
+  # --- Fonts (minimal) ---
+  fonts.enableDefaultPackages = true;
+  fonts.packages = with pkgs; [
+    noto-fonts
+    nerd-fonts.symbols-only
+  ];
+
+  environment.sessionVariables = {
+    XCURSOR_THEME = "Adwaita";
+    XCURSOR_SIZE = "24";
+  };
+
+  # --- User: groups + niri essentials ---
+  users.users.hwebs.extraGroups = [
+    "audio"
+    "input"
+  ];
+
+  users.users.hwebs.packages = with pkgs; [
+    ghostty # terminal
+    fuzzel # launcher
+    swaybg # wallpaper
+    xwayland-satellite # run X11 apps under niri
+    networkmanagerapplet # wifi tray
+    mako # notifications
+    libnotify # notify-send
+  ];
+}
diff --git a/machines/enzo/disko.nix b/machines/enzo/disko.nix
new file mode 100644
index 0000000..ddfa4d3
--- /dev/null
+++ b/machines/enzo/disko.nix
@@ -0,0 +1,93 @@
+# Declarative disk layout for enzo: LVM-on-LUKS with a btrfs root and an
+# encrypted swap logical volume (>= RAM) for hibernation.
+#
+#   nvme0n1
+#   ├─ p1  ESP   1 GiB  vfat  /boot            (unencrypted)
+#   └─ p2  LUKS2 "crypted"  ── LVM vg "vg" ──
+#           ├─ lv "swap"  swap  (hibernation target)
+#           └─ lv "root"  btrfs subvolumes: @ @home @nix @log @snapshots
+#
+# Apply on the laptop with (prompts for the LUKS passphrase = fallback keyslot):
+#   sudo nix run github:nix-community/disko/latest -- \
+#     --mode destroy,format,mount ./machines/enzo/disko.nix
+{ ... }:
+
+{
+  disko.devices = {
+    disk.main = {
+      type = "disk";
+      device = "/dev/nvme0n1"; # TODO: confirm on the laptop with `lsblk`
+      content = {
+        type = "gpt";
+        partitions = {
+          ESP = {
+            size = "1G";
+            type = "EF00";
+            content = {
+              type = "filesystem";
+              format = "vfat";
+              mountpoint = "/boot";
+              mountOptions = [ "umask=0077" ];
+            };
+          };
+          luks = {
+            size = "100%";
+            content = {
+              type = "luks";
+              name = "crypted";
+              settings = {
+                # Allow TRIM through LUKS (minor metadata leak, fine for a laptop SSD).
+                allowDiscards = true;
+              };
+              content = {
+                type = "lvm_pv";
+                vg = "vg";
+              };
+            };
+          };
+        };
+      };
+    };
+
+    lvm_vg.vg = {
+      type = "lvm_vg";
+      lvs = {
+        swap = {
+          size = "20G"; # TODO: set >= RAM (RAM + a little) for hibernation
+          content = {
+            type = "swap";
+            resumeDevice = true; # emits swapDevices + boot.resumeDevice
+          };
+        };
+        root = {
+          size = "100%FREE";
+          content = {
+            type = "btrfs";
+            extraArgs = [ "-f" ];
+            subvolumes = {
+              "@" = {
+                mountpoint = "/";
+                mountOptions = [ "compress=zstd" "noatime" ];
+              };
+              "@home" = {
+                mountpoint = "/home";
+                mountOptions = [ "compress=zstd" "noatime" ];
+              };
+              "@nix" = {
+                mountpoint = "/nix";
+                mountOptions = [ "compress=zstd" "noatime" ];
+              };
+              "@log" = {
+                mountpoint = "/var/log";
+                mountOptions = [ "compress=zstd" "noatime" ];
+              };
+              "@snapshots" = {
+                mountpoint = "/.snapshots";
+              };
+            };
+          };
+        };
+      };
+    };
+  };
+}
diff --git a/machines/enzo/hardware-configuration.nix b/machines/enzo/hardware-configuration.nix
new file mode 100644
index 0000000..30c00ee
--- /dev/null
+++ b/machines/enzo/hardware-configuration.nix
@@ -0,0 +1,27 @@
+# PLACEHOLDER — regenerate on the laptop.
+#
+# During install run:  nixos-generate-config --no-filesystems --root /mnt
+# then copy the generated hardware-configuration.nix over this file. Because the
+# disk layout is declared in ./disko.nix, this file must NOT define fileSystems
+# or swapDevices (--no-filesystems omits them). It only needs to evaluate until
+# the real one is generated; it will NOT boot as-is.
+{ config, lib, pkgs, modulesPath, ... }:
+
+{
+  imports = [
+    (modulesPath + "/installer/scan/not-detected.nix")
+  ];
+
+  # nixos-generate-config fills these in on the laptop. TPM unlock in initrd
+  # needs the TPM module (tpm_tis / tpm_crb) here — usually auto-detected.
+  boot.initrd.availableKernelModules = [ ];
+  boot.initrd.kernelModules = [ ];
+  boot.kernelModules = [ ];
+  boot.extraModulePackages = [ ];
+
+  # fileSystems / swapDevices intentionally omitted — provided by ./disko.nix.
+
+  networking.useDHCP = lib.mkDefault true;
+
+  nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
+}
diff --git a/machines/kusanagi/default.nix b/machines/kusanagi/default.nix
new file mode 100644
index 0000000..10531c2
--- /dev/null
+++ b/machines/kusanagi/default.nix
@@ -0,0 +1,317 @@
+# kusanagi — AMD workstation. Everything here is specific to this machine:
+# ROCm/GPU, the Focusrite Scarlett audio interface, optical-disc archiving, the
+# NAS mounts, and the Kavita/Immich/Ollama servers.
+{ pkgs, ... }:
+
+{
+  imports = [
+    ../../profiles/desktop.nix
+    ../../profiles/dev.nix
+    ../../profiles/apps.nix
+    ./hardware-configuration.nix
+  ];
+
+  networking.hostName = "kusanagi";
+
+  # This value determines the NixOS release from which the default
+  # settings for stateful data, like file locations and database versions
+  # on your system were taken. It‘s perfectly fine and recommended to leave
+  # this value at the release version of the first install of this system.
+  system.stateVersion = "24.11"; # Did you read the comment?
+
+  powerManagement.cpuFreqGovernor = "performance";
+
+  boot.binfmt.emulatedSystems = [ "aarch64-linux" ];
+
+  # --- GPU (ROCm) ---
+  nixpkgs.config.rocmSupport = true;
+  hardware.graphics.extraPackages = with pkgs; [
+    rocmPackages.clr.icd
+  ];
+
+  # --- Optical disc drives / archiving ---
+  boot.kernelModules = [ "sg" ]; # for disc drive
+
+  # For disc drives
+  services.udev.extraRules = ''
+    KERNEL=="sr[0-9]*", GROUP="cdrom", MODE="0660"
+    KERNEL=="sg[0-9]*", GROUP="sg", MODE="0660"
+  '';
+
+  services.pcscd.enable = true;
+
+  # abcde: patch its musicbrainz tool to accept discs with 4 args.
+  nixpkgs.overlays = [
+    (self: super: {
+      abcde = super.abcde.overrideAttrs (oldAttrs: {
+        # We use postInstall to modify the script after it has been copied to the output directory
+        postInstall = (oldAttrs.postInstall or "") + ''
+          # Patch 1: Allow GetOptions to accept 4 arguments (instead of requiring 5+)
+          sed -i 's/discinfo=i{5,}/discinfo=i{4,}/g' $out/bin/abcde-musicbrainz-tool
+
+          # Patch 2: Lower the logic check from 5 to 4
+          sed -i 's/$#discinfo < 5/$#discinfo < 4/g' $out/bin/abcde-musicbrainz-tool
+        '';
+      });
+    })
+  ];
+
+  # --- Scanner ---
+  hardware.sane.enable = true;
+
+  # --- Audio interface (Focusrite Scarlett 18i20) ---
+  # Add this for better pro audio support
+  services.pipewire.extraConfig.pipewire."10-low-latency" = {
+    "context.properties" = {
+      "default.clock.rate" = 48000;
+      "default.clock.quantum" = 256;
+      "default.clock.min-quantum" = 256;
+      "default.clock.max-quantum" = 2048;
+    };
+  };
+
+  # Pin the Scarlett 18i20 to the raw "Pro Audio" profile.
+  # The 26.05 pipewire/wireplumber update began preferring the UCM "HiFi"
+  # profile, which splits the interface into Direct1/Line5/SPDIF1/... sinks and
+  # broke monitoring. This priority rule forces the multichannel Pro Audio
+  # profile statelessly on every boot (and survives future UCM renames).
+  services.pipewire.wireplumber.extraConfig."51-scarlett-pro-audio" = {
+    "device.profile.priority.rules" = [
+      {
+        matches = [
+          {
+            "device.name" = "alsa_card.usb-Focusrite_Scarlett_18i20_USB_P9DCR6Y378D1E6-00";
+          }
+        ];
+        actions = {
+          update-props = {
+            priorities = [ "pro-audio" ];
+          };
+        };
+      }
+    ];
+  };
+
+  # Real-time audio optimizations
+  security.pam.loginLimits = [
+    {
+      domain = "@audio";
+      item = "memlock";
+      type = "-";
+      value = "unlimited";
+    }
+    {
+      domain = "@audio";
+      item = "rtprio";
+      type = "-";
+      value = "99";
+    }
+    {
+      domain = "@audio";
+      item = "nofile";
+      type = "soft";
+      value = "99999";
+    }
+    {
+      domain = "@audio";
+      item = "nofile";
+      type = "hard";
+      value = "99999";
+    }
+  ];
+
+  # Kernel optimizations for audio
+  boot.kernelParams = [
+    "threadirqs"
+    "preempt=full" # if using a PREEMPT kernel
+    # Add USB audio optimizations
+    "usbcore.usbfs_memory_mb=1024"
+  ];
+
+  # --- MPD (music) ---
+  services.mpd.enable = false;
+
+  systemd.user.services.mpd = {
+    description = "Music Player Daemon";
+    after = [
+      "network.target"
+      "sound.target"
+    ];
+    wantedBy = [ "default.target" ];
+    serviceConfig = {
+      ExecStart = "${pkgs.mpd}/bin/mpd --no-daemon";
+      Type = "notify";
+      LimitRTPRIO = 50;
+      LimitRTTIME = "infinity";
+    };
+  };
+
+  # --- NAS (NFS) ---
+  boot.supportedFilesystems = [ "nfs" ];
+
+  services.nfs.server.enable = false;
+  services.rpcbind.enable = true;
+
+  services.nfs.idmapd.settings = {
+    General = {
+      Domain = "kusanagi"; # or your actual domain name
+    };
+  };
+
+  # NAS shares. Use the mDNS-resolvable name (bare "milgrim" doesn't resolve)
+  # and automount on first access so a boot-time DNS/network race can't leave
+  # them unmounted (which silently breaks MPD, whose DB points at these paths).
+  fileSystems."/mnt/milgrim-share" = {
+    device = "milgrim.local:/volume1/share";
+    fsType = "nfs";
+    options = [
+      "nfsvers=4"
+      "rsize=8192"
+      "wsize=8192"
+      "_netdev"
+      "noauto"
+      "x-systemd.automount"
+      "x-systemd.idle-timeout=600"
+      "x-systemd.mount-timeout=10s"
+    ];
+  };
+
+  fileSystems."/mnt/milgrim-public" = {
+    device = "milgrim.local:/volume1/public";
+    fsType = "nfs";
+    options = [
+      "nfsvers=4"
+      "rsize=8192"
+      "wsize=8192"
+      "_netdev"
+      "noauto"
+      "x-systemd.automount"
+      "x-systemd.idle-timeout=600"
+      "x-systemd.mount-timeout=10s"
+    ];
+  };
+
+  # --- Servers ---
+  services.kavita = {
+    enable = true;
+    tokenKeyFile = "/var/lib/kavita/token-key";
+    settings.Port = 5000;
+  };
+
+  systemd.tmpfiles.rules = [
+    "d /srv/library 2750 henz kavita - -"
+  ];
+
+  services.ollama = {
+    enable = true;
+    package = pkgs.ollama-rocm;
+    environmentVariables = {
+      HIP_VISIBLE_DEVICES = "0";
+      OLLAMA_CONTEXT_LENGTH = "32768";
+      OLLAMA_KV_CACHE_TYPE = "q8_0";
+    };
+  };
+
+  services.immich = {
+    enable = true;
+    machine-learning.enable = false;
+  };
+
+  # --- discidurl / haunt tooling (needs the per-machine overlays in flake.nix) ---
+  environment.systemPackages =
+    let
+      # open the MusicBrainz submission URL for the disc in the drive
+      discid = pkgs.writeShellApplication {
+        name = "discid";
+        runtimeInputs = [
+          pkgs.discidurl
+          pkgs.xdg-utils
+        ];
+        text = "discidurl | xargs -r xdg-open";
+      };
+    in
+    with pkgs;
+    [
+      discidurl
+      discid
+      haunt
+    ];
+
+  # --- User account (henz) ---
+  # (Desktop groups audio/lp/input come from profiles/desktop.nix.)
+  users.users.henz.isNormalUser = true;
+  users.users.henz.description = "Henry Webster";
+  users.users.henz.extraGroups = [
+    # base
+    "networkmanager"
+    "wheel"
+    # kusanagi hardware
+    "cdrom"
+    "optical"
+    "sg"
+    "scanner"
+  ];
+
+  nix.settings.trusted-users = [
+    "root"
+    "henz"
+  ];
+
+  users.users.henz.packages = with pkgs; [
+    # base CLI
+    git
+    neovim
+    tmux
+    btop
+    ripgrep
+    unzip
+    xclip
+    bc
+    psmisc
+    usbutils
+    stow
+    nushell
+
+    # kusanagi
+    blender
+    rocmPackages.rpp
+    rocmPackages.hipcc
+    rocmPackages.rocminfo
+    ardour
+    davinci-resolve-studio
+    calf
+    alsa-utils
+    alsa-tools
+    pipewire.jack
+    nfs-utils
+
+    # music
+    mpd
+    mpc
+    ncmpcpp
+
+    # for archiving
+    #makemkv
+    abcde
+    libaacs
+    libbdplus
+    libdvdcss
+    mkvtoolnix
+    dvdbackup
+    chromaprint
+    picard
+    flac
+
+    # scanners
+    simple-scan
+
+    (pkgs.makeDesktopItem {
+      name = "PICO-8";
+      desktopName = "PICO-8";
+      exec = "pico8";
+      icon = "pico8";
+      comment = "Fantasy console for making, sharing and playing tiny games";
+      categories = [ "Game" ];
+    })
+  ];
+}
diff --git a/machines/kusanagi/hardware-configuration.nix b/machines/kusanagi/hardware-configuration.nix
new file mode 100644
index 0000000..9c601e9
--- /dev/null
+++ b/machines/kusanagi/hardware-configuration.nix
@@ -0,0 +1,39 @@
+# Do not modify this file!  It was generated by ‘nixos-generate-config’
+# and may be overwritten by future invocations.  Please make changes
+# to /etc/nixos/configuration.nix instead.
+{ config, lib, pkgs, modulesPath, ... }:
+
+{
+  imports =
+    [ (modulesPath + "/installer/scan/not-detected.nix")
+    ];
+
+  boot.initrd.availableKernelModules = [ "nvme" "xhci_pci" "ahci" "usb_storage" "usbhid" "sd_mod" ];
+  boot.initrd.kernelModules = [ ];
+  boot.kernelModules = [ "kvm-amd" ];
+  boot.extraModulePackages = [ ];
+
+  fileSystems."/" =
+    { device = "/dev/disk/by-uuid/ad74db0c-c909-4503-84f6-cc08ca0b1e4b";
+      fsType = "ext4";
+    };
+
+  fileSystems."/boot" =
+    { device = "/dev/disk/by-uuid/9499-40FE";
+      fsType = "vfat";
+      options = [ "fmask=0077" "dmask=0077" ];
+    };
+
+  swapDevices = [ ];
+
+  # Enables DHCP on each ethernet and wireless interface. In case of scripted networking
+  # (the default) this is the recommended approach. When using systemd-networkd it's
+  # still possible to use this option, but it's recommended to use it in conjunction
+  # with explicit per-interface declarations with `networking.interfaces.<interface>.useDHCP`.
+  networking.useDHCP = lib.mkDefault true;
+  # networking.interfaces.enp9s0.useDHCP = lib.mkDefault true;
+  # networking.interfaces.wlp8s0.useDHCP = lib.mkDefault true;
+
+  nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
+  hardware.cpu.amd.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
+}