Miguel Palhas
c79436d340
yolo's .claude/settings.json was a full fork of the common file, not the narrow override its comment claimed: sandbox, defaultMode, voiceEnabled, $schema and feedbackSurveyState were absent, and five more keys had diverged. It now holds only yolo's overrides and merges over common via recursiveUpdate. sandbox.enabled stays pinned false — inheriting it would newly sandbox every Bash call on a box built for unattended agents. mutableFiles maps a source back to a repo path for the "bring changes upstream" hint, which only works inside the flake tree. Generated sources would print a /nix/store path to copy onto, so add upstreamPath. rev and rev-deploy set Restart=always with RestartSec=2, which burns systemd's default 5-starts-per-10s budget and parks the unit in `failed` until a manual reset-failed. StartLimitIntervalSec=0 lifts the cap. programs.nh.flake and home.mutableFilesRepoPath become mkDefault so yolo overrides them plainly instead of with mkForce in three places. Also clears the outstanding nixfmt and statix findings. The yolo system derivation hash is unchanged. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
52 lines
1.6 KiB
Nix
52 lines
1.6 KiB
Nix
{
|
|
lib,
|
|
...
|
|
}:
|
|
{
|
|
nix = {
|
|
settings = {
|
|
trusted-users = [
|
|
"root"
|
|
"@wheel"
|
|
];
|
|
auto-optimise-store = lib.mkDefault true;
|
|
experimental-features = [
|
|
"nix-command"
|
|
"flakes"
|
|
];
|
|
warn-dirty = false;
|
|
# Keep devshell build inputs alive across GC/`nh clean` so direnv/devenv
|
|
# projects don't re-download/rebuild their shells after a cleanup.
|
|
keep-outputs = true;
|
|
keep-derivations = true;
|
|
};
|
|
# GC is handled by `nh clean` below (keep-N / keep-since semantics).
|
|
# The two are mutually exclusive — nh asserts if nix.gc.automatic is on.
|
|
gc.automatic = false;
|
|
|
|
# Unauthenticated GitHub API calls (flake input fetches) are capped at
|
|
# 60/hr and 429 quickly. The token itself must not land in /nix/store
|
|
# (world-readable), so it lives in a plain file outside Nix's management —
|
|
# !include reads it at nix.conf parse time instead of embedding it.
|
|
extraOptions = ''
|
|
!include /etc/nix/github-token.conf
|
|
'';
|
|
};
|
|
|
|
# nh: ergonomic nixos-rebuild wrapper. Auto-detects the target from the
|
|
# machine hostname (configs are named to match), so `nh os switch` needs
|
|
# no host arg. Runs as root, so its `clean` prunes system + user profiles.
|
|
programs.nh = {
|
|
enable = true;
|
|
# mkDefault: hosts whose clone lives elsewhere (yolo, under ~/tea) override
|
|
# this with a plain assignment.
|
|
flake = lib.mkDefault "/home/naps62/projects/nixos-config";
|
|
clean = {
|
|
enable = true;
|
|
extraArgs = "--keep 10 --keep-since 7d";
|
|
};
|
|
};
|
|
|
|
nixpkgs.config.allowUnfree = true;
|
|
}
|