Restructure into a multi-machine flake and add the enzo laptop

Split the single-host config into a shared minimal base plus opt-in
profiles, and add a second machine (enzo laptop) alongside kusanagi.

- flake: add mkMachine helper; declare nixosConfigurations.kusanagi and
  .enzo; add the disko input; move overlays per-machine.
- common/: minimal base only (boot, networking, tailscale, locale, nix
  settings, neovim editor). Old configuration.nix/programs.nix removed.
- profiles/: coarse opt-in bundles (desktop, dev, apps). kusanagi imports
  all three and stays byte-for-byte identical to the running system.
- machines/kusanagi/: all workstation-only config (ROCm, Scarlett audio,
  optical-disc archiving, NAS mounts, kavita/immich/ollama); hardware
  config moved here unchanged. User stays 'henz'.
- machines/enzo/: new laptop. Declarative LUKS+btrfs via disko
  (LVM-on-LUKS, TPM2+PIN unlock, zram + encrypted swap for
  suspend-then-hibernate); its own minimal niri desktop with
  playback-only audio (no rtkit/jack); user 'hwebs'.

Assisted-by: Claude:claude-opus-4-8

1 files changed, 171 insertions, 0 deletions

diff --git a/profiles/desktop.nix b/profiles/desktop.nix
new file mode 100644
index 0000000..b56ac68
--- /dev/null
+++ b/profiles/desktop.nix
@@ -0,0 +1,171 @@
+# Desktop profile: the GNOME+niri graphical shell, login manager, audio, fonts,
+# graphics, printing, a terminal, and the gpg agent. Opt-in per machine.
+{ pkgs, ... }:
+
+{
+  # Enable the X11 windowing system.
+  services.xserver.enable = true;
+
+  # Configure keymap in X11
+  services.xserver.xkb = {
+    layout = "us";
+    variant = "";
+  };
+
+  # Enable the GNOME Desktop Environment.
+  services.displayManager.gdm.enable = false;
+  services.desktopManager.gnome.enable = true;
+
+  programs.dconf.enable = true;
+  programs.niri.enable = true;
+
+  # login screen
+  services.greetd = {
+    enable = true;
+    settings = {
+      default_session = {
+        command = "${pkgs.tuigreet}/bin/tuigreet --time --remember --cmd niri-session";
+        user = "greeter";
+      };
+    };
+  };
+
+  # This is required to let tuigreet write to its cache (for --remember)
+  systemd.services.greetd.serviceConfig = {
+    Type = "idle";
+    StandardInput = "tty";
+    StandardOutput = "tty";
+    StandardError = "journal"; # Better for debugging
+    TTYReset = true;
+    TTYVHangup = true;
+    TTYVTDisallocate = true;
+  };
+
+  # prevent auto-mounting optical disks
+  services.udisks2.enable = true;
+
+  # Enable CUPS to print documents.
+  services.printing = {
+    enable = true;
+    drivers = with pkgs; [
+      gutenprint
+    ];
+  };
+
+  # mDNS: printer discovery, and resolves kusanagi's *.local NAS names.
+  services.avahi = {
+    enable = true;
+    nssmdns4 = true;
+    openFirewall = true;
+  };
+
+  services.pulseaudio.enable = false;
+  security.rtkit.enable = true;
+  services.pipewire = {
+    enable = true;
+    alsa.enable = true;
+    alsa.support32Bit = true;
+    pulse.enable = true;
+    jack.enable = true;
+    wireplumber.enable = true;
+  };
+
+  programs.gnupg.agent = {
+    enable = true;
+    enableSSHSupport = true;
+  };
+
+  fonts = {
+    enableDefaultPackages = true;
+
+    packages = with pkgs; [
+      noto-fonts-cjk-sans
+      noto-fonts-cjk-serif
+      inter
+      nerd-fonts.symbols-only
+      noto-fonts
+      ibm-plex
+      public-sans
+      adwaita-fonts
+    ];
+
+    fontconfig = {
+      enable = true;
+
+      defaultFonts = {
+        monospace = [
+          "Berkeley Mono"
+          "Liberation Mono"
+          "Symbols Nerd Font"
+        ];
+        sansSerif = [
+          "Liberation Sans"
+          "Noto Sans"
+        ];
+        serif = [ "Liberation Serif" ];
+        emoji = [ "Nerd Font Symbols Only" ];
+      };
+
+      # Force ui-sans-serif and system-ui to resolve correctly
+      localConf = ''
+        <?xml version="1.0"?>
+        <!DOCTYPE fontconfig SYSTEM "urn:fontconfig:fonts.dtd">
+        <fontconfig>
+          <alias>
+            <family>system-ui</family>
+            <prefer>
+              <family>Liberation Sans</family>
+            </prefer>
+          </alias>
+          <alias>
+            <family>ui-sans-serif</family>
+            <prefer>
+              <family>Liberation Sans</family>
+            </prefer>
+          </alias>
+        </fontconfig>
+      '';
+    };
+
+    fontDir.enable = true;
+  };
+
+  environment.sessionVariables = {
+    GSK_RENDERER = "gl";
+    XCURSOR_THEME = "Bibata-Modern-Classic";
+    XCURSOR_SIZE = "24";
+    HYPRCURSOR_THEME = "Bibata-Modern-Classic";
+    HYPRCURSOR_SIZE = "24";
+  };
+
+  # Graphics setup
+  hardware.graphics = {
+    enable = true;
+    enable32Bit = true;
+  };
+
+  users.users.henz.extraGroups = [
+    "audio"
+    "lp"
+    "input"
+  ];
+
+  environment.systemPackages = with pkgs; [
+    # notifications (mako = wayland notification daemon, libnotify = notify-send)
+    mako
+    libnotify
+  ];
+
+  users.users.henz.packages = with pkgs; [
+    ghostty # terminal — required to actually use the GUI
+    gnupg
+    pinentry-gnome3
+
+    # niri support tools
+    waybar
+    networkmanagerapplet
+    xwayland-satellite
+    fuzzel
+    swaybg
+  ];
+}