From 11ba75e40728e8b5735c9c7cefc7af1631c942af Mon Sep 17 00:00:00 2001
From: "Henry J. Webster" <hwebs@hwebs.info>
Date: Thu, 30 Jul 2026 10:38:54 -0500
Subject: Restructure into a multi-machine flake and add the enzo laptop

Split the single-host config into a shared minimal base plus opt-in
profiles, and add a second machine (enzo laptop) alongside kusanagi.

- flake: add mkMachine helper; declare nixosConfigurations.kusanagi and
  .enzo; add the disko input; move overlays per-machine.
- common/: minimal base only (boot, networking, tailscale, locale, nix
  settings, neovim editor). Old configuration.nix/programs.nix removed.
- profiles/: coarse opt-in bundles (desktop, dev, apps). kusanagi imports
  all three and stays byte-for-byte identical to the running system.
- machines/kusanagi/: all workstation-only config (ROCm, Scarlett audio,
  optical-disc archiving, NAS mounts, kavita/immich/ollama); hardware
  config moved here unchanged. User stays 'henz'.
- machines/enzo/: new laptop. Declarative LUKS+btrfs via disko
  (LVM-on-LUKS, TPM2+PIN unlock, zram + encrypted swap for
  suspend-then-hibernate); its own minimal niri desktop with
  playback-only audio (no rtkit/jack); user 'hwebs'.

Assisted-by: Claude:claude-opus-4-8
---
 machines/enzo/default.nix | 91 +++++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 91 insertions(+)
 create mode 100644 machines/enzo/default.nix

(limited to 'machines/enzo/default.nix')

diff --git a/machines/enzo/default.nix b/machines/enzo/default.nix
new file mode 100644
index 0000000..65adef6
--- /dev/null
+++ b/machines/enzo/default.nix
@@ -0,0 +1,91 @@
+# enzo — laptop. Gets the shared common/ base plus laptop-only settings.
+{ inputs, pkgs, ... }:
+
+{
+  imports = [
+    # enzo's own minimal desktop (not the shared profiles/desktop.nix). Add
+    # ../../profiles/dev.nix or apps.nix here, or one-off packages below, as needed.
+    ./desktop.nix
+
+    inputs.disko.nixosModules.disko
+    ./disko.nix
+    ./hardware-configuration.nix
+  ];
+
+  networking.hostName = "enzo";
+
+  # Set this to the NixOS release the laptop is first installed from, then
+  # leave it. (See the comment in machines/kusanagi/default.nix.)
+  system.stateVersion = "26.05";
+
+  # --- User account (hwebs) ---
+  # (Desktop groups audio/input come from ./desktop.nix.)
+  users.users.hwebs = {
+    isNormalUser = true;
+    description = "Henry Webster";
+    extraGroups = [
+      "networkmanager"
+      "wheel"
+    ];
+    packages = with pkgs; [
+      git
+      neovim
+      tmux
+      btop
+      ripgrep
+      unzip
+      xclip
+      bc
+      psmisc
+      usbutils
+      stow
+      nushell
+    ];
+  };
+
+  nix.settings.trusted-users = [
+    "root"
+    "hwebs"
+  ];
+
+  # --- Disk encryption / hibernation / swap ---
+  # systemd in initrd is required for TPM2 unlock and clean hibernate resume.
+  boot.initrd.systemd.enable = true;
+
+  # TPM2 auto-unlock. Enroll the key WITH A PIN post-install:
+  #   sudo systemd-cryptenroll --tpm2-device=auto --tpm2-pcrs=7 \
+  #     --tpm2-with-pin=yes /dev/nvme0n1p2
+  # The original LUKS passphrase stays as a fallback keyslot. disko already
+  # declares boot.initrd.luks.devices."crypted".device.
+  boot.initrd.luks.devices."crypted".crypttabExtraOpts = [ "tpm2-device=auto" ];
+
+  # zram for everyday paging; the encrypted LVM swap from disko.nix is the
+  # hibernation target (boot.resumeDevice comes from disko's resumeDevice=true).
+  zramSwap.enable = true;
+
+  # Suspend-to-RAM on lid close, auto-hibernate after a delay so a dying battery
+  # doesn't lose the session. Everyday resume needs only the login password; the
+  # LUKS PIN appears only on cold boot / hibernate resume.
+  services.logind.settings.Login.HandleLidSwitch = "suspend-then-hibernate";
+  systemd.sleep.settings.Sleep.HibernateDelaySec = "60min";
+
+  # btrfs + SSD upkeep.
+  services.btrfs.autoScrub.enable = true;
+  services.fstrim.enable = true;
+
+  # --- Laptop power management ---
+  # power-profiles-daemon integrates with GNOME's power settings. If you prefer
+  # finer-grained control, disable this and enable services.tlp instead.
+  services.power-profiles-daemon.enable = true;
+  powerManagement.enable = true;
+
+  # Backlight control from the CLI / keybinds (programs.light was removed from
+  # nixpkgs; acpilight provides the udev rules and brightnessctl the CLI).
+  hardware.acpilight.enable = true;
+  environment.systemPackages = [ pkgs.brightnessctl ];
+
+  # --- GPU ---
+  # TODO: adjust for the laptop's actual GPU once known. For an Intel iGPU add
+  # intel-media-driver to hardware.graphics.extraPackages; for a discrete AMD
+  # GPU you may want ROCm as in machines/kusanagi/default.nix.
+}
-- 
cgit v1.3