refactor: simplify bash configuration

.mcp.json

@@ -0,0 +1,7 @@
+{
+  "mcpServers": {
+    "nixos": {
+      "command": "mcp-nixos"
+    }
+  }
+}

deploy/colmena.nix

@@ -4,6 +4,10 @@
 }:
 
 let
+  inherit (inputs.nixpkgs) lib;
+  utils = import ../utils { inherit lib; };
+  hostDirNames = utils.dirNames ../hosts;
+
   mkNode = hostname: tags: {
     imports = [ ../hosts/${hostname} ];
     deployment = {
@@ -13,6 +17,10 @@ let
       inherit tags;
     };
   };
+
+  nodes = lib.genAttrs hostDirNames (hostname:
+    mkNode hostname (utils.hostMeta ../hosts/${hostname}).deployment.tags
+  );
 in
 inputs.colmena.lib.makeHive {
   meta = {
@@ -24,9 +32,5 @@ inputs.colmena.lib.makeHive {
     nodeSpecialArgs = builtins.mapAttrs (_: v: v._module.specialArgs or { }) self.nixosConfigurations;
   };
 
-  astyanax = mkNode "astyanax" [ "local" ];
-  andromache = mkNode "andromache" [ "local" ];
-  vm = mkNode "vm" [ "local" ];
-  hecuba = mkNode "hecuba" [ "cloud" ];
-  eetion = mkNode "eetion" [ "arm" ];
+  inherit nodes;
 }

home/hosts/andromache/default.nix

@@ -47,12 +47,8 @@ in
   cloud.hetzner.enable = true;
   comms.signal.enable = true;
   github.enable = true;
-  pandoc.enable = true;
-
-  shell.bash = {
-    enable = true;
-    aliases.lang-js = true;
-  };
+  shell.bash.aliases.lang-js = true;
+  shell.bash.addBinToPath = true;
 
   programs = {
     home-manager.enable = true;

home/hosts/astyanax/default.nix

@@ -45,13 +45,8 @@ in
   cloud.hetzner.enable = true;
   comms.signal.enable = true;
   github.enable = true;
-  nfc.proxmark3.enable = true;
-  pandoc.enable = true;
-
-  shell.bash = {
-    enable = true;
-    aliases.lang-js = true;
-  };
+  shell.bash.aliases.lang-js = true;
+  shell.bash.addBinToPath = true;
 
   programs = {
     home-manager.enable = true;

home/hosts/work/default.nix

@@ -18,12 +18,14 @@ in
     ../../modules/bruno
     ../../modules/cloud
     ../../modules/comms
+    ../../modules/database
     ../../modules/dconf
     ../../modules/desktop/niri
     ../../modules/direnv
     ../../modules/docker
     ../../modules/git
     ../../modules/go
+    ../../modules/infra
     ../../modules/k8s
     ../../modules/k8s/k9s.nix
     ../../modules/keepassxc
@@ -100,16 +102,11 @@ in
     claude-code.enable = true;
     opencode.enable = true;
   };
+  database.mssql.enable = true;
+  database.postgresql.enable = true;
   github.enable = true;
   gitlab.enable = true;
-  pandoc.enable = true;
-  secrets = {
-    enable = true;
-    vault.enable = true;
-  };
-
-  shell.bash.enable = true;
-  starship.enable = true;
+  secrets.vault.enable = true;
 
   programs = {
     gh.enable = true;

home/modules/anki/default.nix

@@ -26,7 +26,7 @@ in
       puppy-reinforcement
       review-heatmap
     ];
-    sync = lib.mkIf sopsAvailable {
+    profiles."User 1".sync = lib.mkIf sopsAvailable {
       usernameFile = "${sopsSecrets."anki_sync_user".path}";
       keyFile = "${sopsSecrets."anki_sync_key".path}";
     };

home/modules/database/default.nix

@@ -0,0 +1,22 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+
+{
+  options.database = {
+    mssql.enable = lib.mkEnableOption "MSSQL";
+    postgresql.enable = lib.mkEnableOption "PostgreSQL";
+  };
+
+  config = lib.mkMerge [
+    (lib.mkIf config.database.mssql.enable {
+      home.packages = [ (config.nixgl.wrap pkgs.dbeaver-bin) ];
+    })
+    (lib.mkIf config.database.postgresql.enable {
+      home.packages = [ (config.nixgl.wrap pkgs.pgadmin4-desktopmode) ];
+    })
+  ];
+}

home/modules/go/default.nix

@@ -1,18 +1,7 @@
+{ pkgs, ... }:
 {
-  config,
-  lib,
-  pkgs,
-  ...
-}:
-{
-  options.go = {
-    enable = lib.mkEnableOption "go language";
-  };
-
-  config = lib.mkIf config.go.enable {
-    home.packages = with pkgs; [
-      go
-      gopls
-    ];
-  };
+  home.packages = with pkgs; [
+    go
+    gopls
+  ];
 }

home/modules/infra/default.nix

@@ -0,0 +1,10 @@
+{ pkgs, ... }:
+
+{
+  config = {
+    home.packages = with pkgs; [
+      opentofu
+      upbound
+    ];
+  };
+}

home/modules/nfc/proxmark3.nix

@@ -1,21 +1,6 @@
+{ pkgs, ... }:
 {
-  config,
-  lib,
-  pkgs,
-  ...
-}:
-
-let
-  cfg = config.nfc.proxmark3;
-in
-{
-  options.nfc.proxmark3 = {
-    enable = lib.mkEnableOption "proxmark3 (iceman fork)";
-  };
-
-  config = lib.mkIf cfg.enable {
-    home.packages = [
-      (pkgs.proxmark3.override { withGeneric = true; })
-    ];
-  };
+  home.packages = [
+    (pkgs.proxmark3.override { withGeneric = true; })
+  ];
 }

home/modules/nodejs.nix

@@ -6,15 +6,12 @@
 }:
 
 {
-  options.nodejs = {
-    enable = lib.mkEnableOption "nodejs (and related packages)";
-    package = lib.mkOption {
-      type = lib.types.package;
-      default = pkgs.nodejs_24;
-    };
+  options.nodejs.package = lib.mkOption {
+    type = lib.types.package;
+    default = pkgs.nodejs_24;
   };
 
-  config = lib.mkIf config.nodejs.enable {
+  config = {
     home.packages = with pkgs; [
       config.nodejs.package
       pnpm

home/modules/pandoc/default.nix

@@ -1,19 +1,8 @@
+{ pkgs, ... }:
 {
-  config,
-  lib,
-  pkgs,
-  ...
-}:
-{
-  options.pandoc = {
-    enable = lib.mkEnableOption "pandoc";
-  };
-
-  config = lib.mkIf config.pandoc.enable {
-    home.packages = with pkgs; [
-      haskellPackages.pandoc-crossref
-      pandoc
-      texliveSmall
-    ];
-  };
+  home.packages = with pkgs; [
+    haskellPackages.pandoc-crossref
+    pandoc
+    texliveSmall
+  ];
 }

home/modules/secrets/default.nix

@@ -1,20 +1,13 @@
 {
-  config,
   lib,
   pkgs,
   ...
 }:
 {
-  options.secrets = {
-    enable = lib.mkEnableOption "secrets";
-  };
-
   imports = [ ./vault.nix ];
 
-  config = lib.mkIf config.secrets.enable {
-    home.packages = with pkgs; [
-      sops
-      age
-    ];
-  };
+  home.packages = with pkgs; [
+    sops
+    age
+  ];
 }

home/modules/shell/bash.nix

@@ -9,38 +9,32 @@ let
   inherit (config.home) username;
 in
 {
-  options.shell.bash = {
-    enable = lib.mkEnableOption "bash configuration";
+  imports = [ ./utils.nix ];
 
+  options.shell.bash = {
     aliases = {
       all = lib.mkOption {
         type = lib.types.bool;
         default = true;
-        description = "Enable common aliases";
       };
       lang-js = lib.mkOption {
         type = lib.types.bool;
         default = false;
-        description = "Enable JavaScript/Node.js aliases";
       };
     };
 
     addBinToPath = lib.mkOption {
       type = lib.types.bool;
-      default = true;
-      description = "Add dots .bin directory to PATH";
+      default = false;
     };
 
     extraInit = lib.mkOption {
       type = lib.types.lines;
       default = "";
-      description = "Additional bash initialization";
     };
   };
 
-  config = lib.mkIf cfg.enable {
-    shell-utils.enable = lib.mkDefault true;
-
+  config = {
     programs.bash = {
       enable = true;
       enableCompletion = true;

home/modules/shell/prompt.nix

@@ -1,16 +1,3 @@
 {
-  config,
-  lib,
-  ...
-}:
-{
-  options.starship = {
-    enable = lib.mkEnableOption "starship prompt";
-  };
-
-  config = lib.mkIf config.starship.enable {
-    programs.starship = {
-      enable = true;
-    };
-  };
+  programs.starship.enable = true;
 }

home/modules/shell/utils.nix

@@ -1,26 +1,19 @@
 {
-  config,
   lib,
   pkgs,
   ...
 }:
 {
-  options.shell-utils = {
-    enable = lib.mkEnableOption "shell utilities";
+  programs.fzf = {
+    enable = true;
+    enableBashIntegration = lib.mkDefault true;
   };
 
-  config = lib.mkIf config.shell-utils.enable {
-    programs.fzf = {
-      enable = true;
-      enableBashIntegration = lib.mkDefault true;
-    };
-
-    home.packages = with pkgs; [
-      ripgrep
-      bat
-      jq
-      entr
-      parallel
-    ];
-  };
+  home.packages = with pkgs; [
+    ripgrep
+    bat
+    jq
+    entr
+    parallel
+  ];
 }

home/modules/vscode.nix

@@ -2,6 +2,6 @@
 
 {
   config = {
-    home.packages = [ (config.nixgl.wrap (config.wrapApp pkgs.vscode "--disable-gpu-sandbox")) ];
+    home.packages = [ (config.nixgl.wrap (config.wrapApp pkgs.vscode "--no-sandbox")) ];
   };
 }

hosts/andromache/default.nix

@@ -35,7 +35,7 @@ in
     ../../modules/audio
     ../../modules/localization
     ../../modules/fonts
-    ../../modules/ssh/hardened-openssh.nix
+    ../../modules/ssh
     ../../modules/storage
     ../../modules/stylix
     (import ../../modules/secrets { inherit lib inputs config; })
@@ -62,8 +62,6 @@ in
   secrets.username = username;
   docker.user = username;
 
-  nix.settings.secret-key-files = [ config.sops.secrets.nix_signing_key_andromache.path ];
-
   disko.devices = {
     disk.data = {
       type = "disk";
@@ -111,16 +109,9 @@ in
     ];
   };
 
-  services = {
-    locate = {
-      enable = true;
-      package = pkgs.plocate;
-    };
-
-    openssh = {
-      enable = true;
-      harden = true;
-    };
+  services.locate = {
+    enable = true;
+    package = pkgs.plocate;
   };
 
   networking = {

hosts/andromache/meta.nix

@@ -0,0 +1,4 @@
+{
+  deployment.tags = [ "local" ];
+  role = "desktop";
+}

hosts/astyanax/default.nix

@@ -34,7 +34,7 @@ in
     ../../modules/users
     ../../modules/localization
     ../../modules/fonts
-    ../../modules/ssh/hardened-openssh.nix
+    ../../modules/ssh
     ../../modules/storage
     ../../modules/stylix
     (import ../../modules/secrets { inherit lib inputs config; })
@@ -61,8 +61,6 @@ in
   nfc.user = username;
   desktop.ly.enable = true;
 
-  nix.settings.secret-key-files = [ config.sops.secrets.nix_signing_key_astyanax.path ];
-
   hardware = {
     cpu.intel.updateMicrocode = true;
     # https://wiki.nixos.org/wiki/Intel_Graphics
@@ -100,10 +98,6 @@ in
 
   services = {
     fwupd.enable = true;
-    openssh = {
-      enable = true;
-      harden = true;
-    };
     locate = {
       enable = true;
       package = pkgs.plocate;

hosts/astyanax/meta.nix

@@ -0,0 +1,4 @@
+{
+  deployment.tags = [ "local" ];
+  role = "laptop";
+}

hosts/eetion-02/default.nix

@@ -10,7 +10,7 @@ in
 {
   imports = [
     ./hard.nix
-    ../../modules/ssh/hardened-openssh.nix
+    ../../modules/ssh
   ];
 
   ssh = {
@@ -59,13 +59,6 @@ in
 
   security.sudo.wheelNeedsPassword = false;
 
-  services = {
-    openssh = {
-      enable = true;
-      harden = true;
-    };
-  };
-
   environment.systemPackages = with pkgs; [
     vim
     git

hosts/eetion-02/meta.nix

@@ -0,0 +1,4 @@
+{
+  deployment.tags = [ "arm" ];
+  role = "embedded";
+}

hosts/eetion/default.nix

@@ -10,7 +10,8 @@ in
 {
   imports = [
     ./hard.nix
-    ../../modules/ssh/hardened-openssh.nix
+    ../../modules/ssh
+    # ../../modules/uptime-kuma
   ];
 
   ssh = {
@@ -52,11 +53,6 @@ in
   security.sudo.wheelNeedsPassword = false;
 
   services = {
-    openssh = {
-      enable = true;
-      harden = true;
-    };
-
     paperless = {
       enable = true;
       passwordFile = "/etc/paperless-admin-pass";

hosts/eetion/meta.nix

@@ -0,0 +1,4 @@
+{
+  deployment.tags = [ "arm" ];
+  role = "embedded";
+}

hosts/hecuba/default.nix

@@ -15,9 +15,8 @@ in
     inputs.disko.nixosModules.disko
     ../../modules/common
     ./hard.nix
-    ../../modules/ssh/hardened-openssh.nix
+    ../../modules/ssh
     ../../modules/docker
-    ../../modules/uptime-kuma
   ];
 
   networking.hostName = hostName;
@@ -32,8 +31,6 @@ in
 
   docker.user = username;
 
-  my.uptime-kuma.enable = false;
-
   fileSystems."/" = {
     device = "/dev/disk/by-label/nixos";
     fsType = "ext4";
@@ -78,9 +75,4 @@ in
     enable = true;
     maxretry = 5;
   };
-
-  services.openssh = {
-    enable = true;
-    harden = true;
-  };
 }

hosts/hecuba/meta.nix

@@ -0,0 +1,4 @@
+{
+  deployment.tags = [ "cloud" ];
+  role = "server";
+}

hosts/vm/default.nix

@@ -24,7 +24,7 @@ in
     ../../modules/localization
     ../../modules/x
     ../../modules/fonts
-    ../../modules/ssh/hardened-openssh.nix
+    ../../modules/ssh
     ../../modules/storage
     (import ../../modules/secrets {
       inherit lib inputs config;
@@ -63,9 +63,5 @@ in
   services = {
     qemuGuest.enable = true;
     spice-vdagentd.enable = true;
-    openssh = {
-      enable = true;
-      harden = true;
-    };
   };
 }

hosts/vm/meta.nix

@@ -0,0 +1,4 @@
+{
+  deployment.tags = [ "local" ];
+  role = "vm";
+}

images/sd-image-orange-pi-aarch64.nix

@@ -12,7 +12,7 @@ let
 in
 {
   imports = [
-    ../modules/ssh/hardened-openssh.nix
+    ../modules/ssh
   ];
 
   ssh.username = username;
@@ -37,21 +37,5 @@ in
 
   security.sudo.wheelNeedsPassword = false;
 
-  services.openssh = {
-    enable = true;
-    harden = true;
-  };
-
-  # sdImage.postBuildCommands =
-  #   let
-  #     bootloaderPackage = pkgs.ubootOrangePiZero2;
-  #     bootloaderSubpath = "/u-boot-sunxi-with-spl.bin";
-  #   in
-  #   ''
-  #     dd if=${bootloaderPackage}${bootloaderSubpath} of=$img \
-  #       bs=8 seek=1024 \
-  #       conv=notrunc
-  #   '';
-
   system.stateVersion = "26.05";
 }

images/sd-image-raspberry-pi-aarch64.nix

@@ -12,7 +12,7 @@ let
 in
 {
   imports = [
-    ../modules/ssh/hardened-openssh.nix
+    ../modules/ssh
   ];
 
   ssh.username = username;
@@ -60,11 +60,6 @@ in
 
   security.sudo.wheelNeedsPassword = false;
 
-  services.openssh = {
-    enable = true;
-    harden = true;
-  };
-
   environment.systemPackages = with pkgs; [
     libraspberrypi
   ];

modules/secrets/default.nix

@@ -29,8 +29,6 @@ in
         "anki_sync_user".owner = config.users.users.${cfg.username}.name;
         "anki_sync_key".owner = config.users.users.${cfg.username}.name;
         "hcloud".owner = config.users.users.${cfg.username}.name;
-        "nix_signing_key_astyanax" = { };
-        "nix_signing_key_andromache" = { };
         "opencode_api_key".owner = config.users.users.${cfg.username}.name;
         # TODO: using shared secrets for now, but would be better to to per-host secrets
         # To add per-host secrets:

modules/ssh/default.nix

@@ -0,0 +1,10 @@
+{ lib, ... }:
+
+{
+  imports = [ ./hardened-openssh.nix ];
+
+  config.services.openssh = {
+    enable = lib.mkDefault true;
+    harden = lib.mkDefault true;
+  };
+}

modules/syncthing/default.nix

@@ -10,15 +10,12 @@ let
   cfg = config.my.syncthing;
 in
 {
-  options.my.syncthing = {
-    enable = mkEnableOption "Syncthing file synchronization";
-    username = mkOption {
-      type = types.str;
-      default = "h";
-    };
+  options.my.syncthing.username = mkOption {
+    type = types.str;
+    default = "h";
   };
 
-  config = mkIf cfg.enable {
+  config = {
     users.groups.${cfg.username} = { };
     users.users.${cfg.username}.extraGroups = [ cfg.username ];
 

modules/uptime-kuma/default.nix

@@ -1,39 +1,30 @@
 {
-  config,
-  lib,
   pkgs,
   ...
 }:
 
-let
-  cfg = config.my.uptime-kuma;
-in
 {
-  options.my.uptime-kuma.enable = lib.mkEnableOption "Uptime Kuma monitoring service (Docker container)";
-
-  config = lib.mkIf cfg.enable {
-    virtualisation.oci-containers = {
-      backend = "docker";
-      containers.uptime-kuma = {
-        image = "louislam/uptime-kuma:latest";
-        ports = [ "127.0.0.1:3001:3001" ];
-        volumes = [ "/var/lib/uptime-kuma:/app/data" ];
-        environment = {
-          TZ = "UTC";
-          UMASK = "0022";
-        };
-        extraOptions = [
-          "--network=proxiable"
-        ];
+  virtualisation.oci-containers = {
+    backend = "docker";
+    containers.uptime-kuma = {
+      image = "louislam/uptime-kuma:latest";
+      ports = [ "127.0.0.1:3001:3001" ];
+      volumes = [ "/var/lib/uptime-kuma:/app/data" ];
+      environment = {
+        TZ = "UTC";
+        UMASK = "0022";
       };
+      extraOptions = [
+        "--network=proxiable"
+      ];
     };
-
-    systemd.tmpfiles.settings."uptime-kuma" = {
-      "/var/lib/uptime-kuma".d = {
-        mode = "0755";
-      };
-    };
-
-    environment.systemPackages = with pkgs; [ docker-compose ];
   };
+
+  systemd.tmpfiles.settings."uptime-kuma" = {
+    "/var/lib/uptime-kuma".d = {
+      mode = "0755";
+    };
+  };
+
+  environment.systemPackages = with pkgs; [ docker-compose ];
 }

utils/default.nix

@@ -3,4 +3,9 @@
 {
   dirNames =
     path: builtins.attrNames (lib.filterAttrs (_: type: type == "directory") (builtins.readDir path));
+
+  hostMeta = hostDir:
+    if builtins.pathExists (hostDir + "/meta.nix")
+    then import (hostDir + "/meta.nix")
+    else throw "meta.nix required in ${hostDir}";
 }