feat: add one-command laptop configuration sync

switch-system.sh

@@ -0,0 +1,44 @@
+#!/usr/bin/env bash
+# Apply this laptop's checkout, never the separate EC2 "dev" configuration.
+set -euo pipefail
+
+usage() {
+  printf 'Usage: %s [switch|dry-activate|boot|test]\n' "$0"
+  printf '%s\n' \
+    'Build /etc/nix#nixos using flake.lock; default: switch now and save for boot.' \
+    'dry-activate previews changes; boot stages them; test applies temporarily.' \
+    'Does not pull Git, update package pins, delete generations, or reboot.'
+}
+
+if [[ $# -eq 1 && ($1 == --help || $1 == -h) ]]; then
+  usage
+  exit 0
+fi
+if (($# > 1)); then
+  usage >&2
+  exit 2
+fi
+action=${1:-switch}
+case "$action" in
+  switch | dry-activate | boot | test) ;;
+  *)
+    usage >&2
+    exit 2
+    ;;
+esac
+
+if ((EUID != 0)); then
+  exec sudo -- "$(readlink -f -- "${BASH_SOURCE[0]}")" "$@"
+fi
+
+# Share the existing updater's lock so it cannot change the checkout/profile
+# underneath this build and activation.
+mkdir -p /var/cache/nixos-update
+exec 9>/var/cache/nixos-update/lock
+flock 9
+
+cd /etc/nix
+printf 'Building the current /etc/nix checkout for nixos (%s).\n' "$action"
+built=$(nix build .#nixosConfigurations.nixos.config.system.build.toplevel \
+  --no-update-lock-file --no-link --print-out-paths)
+exec "$built/sw/bin/nixos-rebuild" "$action" --no-reexec --store-path "$built"