feat: declare locked NixOS development host

Declare dev, scoped sudo/SSH, workspace ownership, Git and Neovim. Lock Nixpkgs, Home Manager and the unmodified dotfiles. Deploy user files declaratively and preserve a writable Lazy lockfile.

Nix formatting and pure flake evaluation pass. Full build, empty-home deployment tests and activation of this reproducibility correction are still pending; the previous account baseline is live.

.editorconfig

@@ -0,0 +1,12 @@
+root = true
+
+[*]
+charset = utf-8
+end_of_line = lf
+indent_style = space
+indent_size = 2
+insert_final_newline = true
+trim_trailing_whitespace = true
+
+[*.md]
+trim_trailing_whitespace = false

.gitignore

@@ -0,0 +1,15 @@
+# Nix build results and local environment state.
+/result
+/result-*
+/.direnv/
+
+# Local secrets must never be imported into Nix or committed.
+/.env
+/.env.*
+!/.env.example
+/secrets/
+
+# Editor temporary files.
+*.swp
+*.swo
+*~

README.md

@@ -0,0 +1,76 @@
+# Development host
+
+Flat, explicit NixOS modules, with locked inputs. Required machine setup belongs in these configs—not a list of manual installs or dotfile copies.
+
+| File | Owns |
+| --- | --- |
+| `flake.nix`, `flake.lock` | Host entry point and exact Nixpkgs/Home Manager/dotfile revisions and content hashes |
+| `configuration.nix` | EC2 base, platform, Nix features, compatibility version, imports |
+| `users.nix` | `dev`, SSH/sudo, Home Manager integration, workspace/repo ownership |
+| `dev-authorized-keys` | Public SSH keys for `dev`—never private keys |
+| `tools.nix` | Git, declarative user Git policy, official Nix formatter |
+| `neovim.nix` | Editor and deployment of the unchanged upstream dotfiles |
+
+## Account
+
+- Daily user: `dev`, UID 1001, home `/home/dev`, workspace `~/projects`.
+- Passwordless sudo is scoped to `dev`; existing SSM-user administration and root SSH recovery remain intact.
+- `dev` is authorized by the public key in this repo. No private key or password is embedded.
+- `/etc/nixos` is writable by `dev` through a native tmpfiles ownership rule, which does not follow store symlinks.
+- Nix daemon access stays untrusted for ordinary use. Sudo is a separate, explicit administrative capability.
+- Bash is the temporary default; further shell/workflow preferences remain the user's choice.
+
+Enter from an administrator session with `sudo -iu dev`.
+
+Git author identity and remote destination are deliberately unset. `user.useConfigOnly` is now a Home Manager setting in `tools.nix`, not a required manual `git config` step.
+
+## Build and apply
+
+As `dev`, from `/etc/nixos`:
+
+```sh
+nixfmt --check ./*.nix
+nix flake check --no-update-lock-file
+nix build .#nixosConfigurations.dev.config.system.build.toplevel --no-update-lock-file
+```
+
+New source files must be added to Git for flakes to see them. Keep `flake.lock` in version control. A build does **not** activate changes.
+
+Review and activate exactly the built closure:
+
+```sh
+sudo nixos-rebuild dry-activate --store-path "$(readlink -f result)"
+sudo nixos-rebuild switch --store-path "$(readlink -f result)"
+```
+
+For initial deployment on a compatible NixOS EC2 base where flakes are not enabled yet, check out this repo and run the build as an existing administrator with the temporary CLI flag:
+
+```sh
+nix --extra-experimental-features 'nix-command flakes' build \
+  .#nixosConfigurations.dev.config.system.build.toplevel --no-update-lock-file
+```
+
+Then review/apply the resulting closure as above. The configuration creates `dev`, sets permissions and deploys its files. **No separate Neovim clone, copy, useradd, chown or global Git-config recipe is required.**
+
+This host build does not use a mutable channel. NixOS's native flake integration also pins the `nixpkgs` registry entry and `<nixpkgs>` lookup to the system input. Dev-environment templates/composition remain deferred; there is no flake framework here.
+
+## Neovim: import, do not rewrite
+
+The input is [the existing neovim-dots repository](https://git.cyber.ayyalasomayajula.net/marsultor/neovim-dots), initially pinned to `380eb86778a7c53a0f1c18e84f14037456155347`.
+
+Home Manager deploys its files under `~/.config/nvim`, with the **Lua, AstroNvim, Lazy, Mason, plugins and keymaps unchanged**. `programs.neovim.configure` stays empty so Neovim discovers `init.lua` normally. No Nixvim or custom Lua loader.
+
+- Configuration files are linked from the pinned source and managed by Nix. Change the upstream repo and its input revision rather than editing generated links.
+- Lazy's `lazy-lock.json` must remain writable. The config seeds a copy at `~/.local/state/nvim/locks/<dotfile-revision>.json` and links to it. A new dotfile revision gets its own original lock; repeated activation preserves runtime changes to an existing lock.
+- A declared migration preserves the earlier manual checkout intact at `~/projects/neovim-dots-before-nix`. It refuses to overwrite an existing backup. On a clean home this migration does nothing.
+
+**Reproducibility boundary:** Nix locks the host inputs and dotfile source, and reproduces their deployment. The existing Lua still bootstraps Lazy and manages plugin/Mason downloads at runtime. The supplied Lazy lock records plugin revisions, but it is writable and Mason's tool versions are not pinned by this Nix config. This is not a claim that every runtime download/cache is a Nix-reproducible build. Changing that policy requires a separate agreement; do not silently replace the user's plugin managers.
+
+## Updates and safety
+
+- To change a pinned source, update its revision in `flake.nix`, regenerate `flake.lock` with `nix flake lock`, review the diff, then check/build before switching. No unattended updates.
+- Keep the EC2 module, sandboxing, signature verification and recovery access intact.
+- `system.stateVersion` and `home.stateVersion` are both `26.05`; these preserve compatibility, not package versions.
+- `test` activates changes too; it is not a dry run. Keep the original system generation.
+- Rollbacks do not restore mutable user/application data, lockfile updates, backups, or this Git working tree.
+- No private keys, plaintext secrets, build outputs or agent notes in this repo.

configuration.nix

@@ -0,0 +1,26 @@
+{ inputs, modulesPath, ... }:
+
+{
+  imports = [
+    # Keep the image's EC2 boot, storage, metadata, SSH and SSM integration.
+    "${modulesPath}/virtualisation/amazon-image.nix"
+    ./users.nix
+    ./tools.nix
+    ./neovim.nix
+  ];
+
+  nixpkgs.hostPlatform = "x86_64-linux";
+
+  nix = {
+    channel.enable = false;
+    settings.experimental-features = [
+      "nix-command"
+      "flakes"
+    ];
+  };
+
+  system.configurationRevision = inputs.self.rev or inputs.self.dirtyRev or null;
+
+  # Initial data/default compatibility, not the desired package release.
+  system.stateVersion = "26.05";
+}

dev-authorized-keys

@@ -0,0 +1 @@
+ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIPQKGcukJjCK6wu4iMoHlEgaCN2gnR4pEKFjpMgn78yI krishna pub

flake.lock

@@ -0,0 +1,68 @@
+{
+  "nodes": {
+    "home-manager": {
+      "inputs": {
+        "nixpkgs": [
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1787377438,
+        "narHash": "sha256-Sxu1NLTD/Ern6hFGLlZmtKCSct3YQXZI/lls8RE1XeM=",
+        "owner": "nix-community",
+        "repo": "home-manager",
+        "rev": "65258d5c65a250189fde2e35f490d15e064c4c62",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nix-community",
+        "repo": "home-manager",
+        "rev": "65258d5c65a250189fde2e35f490d15e064c4c62",
+        "type": "github"
+      }
+    },
+    "neovim-dots": {
+      "flake": false,
+      "locked": {
+        "lastModified": 1780499261,
+        "narHash": "sha256-ScMf9MqK4EyEU0/Ki134efrPa8azNxgALnTfgiaLA3w=",
+        "ref": "main",
+        "rev": "380eb86778a7c53a0f1c18e84f14037456155347",
+        "revCount": 17,
+        "type": "git",
+        "url": "https://git.cyber.ayyalasomayajula.net/marsultor/neovim-dots"
+      },
+      "original": {
+        "ref": "main",
+        "rev": "380eb86778a7c53a0f1c18e84f14037456155347",
+        "type": "git",
+        "url": "https://git.cyber.ayyalasomayajula.net/marsultor/neovim-dots"
+      }
+    },
+    "nixpkgs": {
+      "locked": {
+        "lastModified": 1787848966,
+        "narHash": "sha256-7gDpu5hpq0rOYnYMcOWqSzquK4HA/xU8Xf3CjUBOOJA=",
+        "owner": "NixOS",
+        "repo": "nixpkgs",
+        "rev": "d57af924f160a5084293c71c2043f058bd1cdb60",
+        "type": "github"
+      },
+      "original": {
+        "owner": "NixOS",
+        "repo": "nixpkgs",
+        "rev": "d57af924f160a5084293c71c2043f058bd1cdb60",
+        "type": "github"
+      }
+    },
+    "root": {
+      "inputs": {
+        "home-manager": "home-manager",
+        "neovim-dots": "neovim-dots",
+        "nixpkgs": "nixpkgs"
+      }
+    }
+  },
+  "root": "root",
+  "version": 7
+}

flake.nix

@@ -0,0 +1,32 @@
+{
+  description = "Development host";
+
+  inputs = {
+    # Keep the machine's existing Nixpkgs revision; this is not an upgrade.
+    nixpkgs.url = "github:NixOS/nixpkgs/d57af924f160a5084293c71c2043f058bd1cdb60";
+
+    home-manager = {
+      url = "github:nix-community/home-manager/65258d5c65a250189fde2e35f490d15e064c4c62";
+      inputs.nixpkgs.follows = "nixpkgs";
+    };
+
+    neovim-dots = {
+      url = "git+https://git.cyber.ayyalasomayajula.net/marsultor/neovim-dots?ref=main&rev=380eb86778a7c53a0f1c18e84f14037456155347";
+      flake = false;
+    };
+  };
+
+  outputs =
+    inputs@{ nixpkgs, home-manager, ... }:
+    {
+      nixosConfigurations.dev = nixpkgs.lib.nixosSystem {
+        specialArgs = { inherit inputs; };
+        modules = [
+          ./configuration.nix
+          home-manager.nixosModules.home-manager
+        ];
+      };
+
+      formatter.x86_64-linux = nixpkgs.legacyPackages.x86_64-linux.nixfmt;
+    };
+}

neovim.nix

@@ -0,0 +1,51 @@
+{ inputs, ... }:
+
+{
+  programs.neovim = {
+    enable = true;
+    defaultEditor = true;
+    # Leave configure empty: load the user's init.lua normally.
+  };
+
+  home-manager.users.dev =
+    { config, lib, ... }:
+    let
+      dots = inputs.neovim-dots;
+      configDir = "${config.xdg.configHome}/nvim";
+      lockFile = "${config.xdg.stateHome}/nvim/locks/${dots.rev}.json";
+      backup = "${config.home.homeDirectory}/projects/neovim-dots-before-nix";
+    in
+    {
+      # Import the original repo, without translating or patching its Lua.
+      xdg.configFile."nvim" = {
+        source = lib.cleanSourceWith {
+          src = dots;
+          filter = path: _: baseNameOf path != "lazy-lock.json";
+        };
+        recursive = true;
+      };
+
+      # Lazy writes this file. Seed a writable copy per pinned config revision.
+      xdg.configFile."nvim/lazy-lock.json".source = config.lib.file.mkOutOfStoreSymlink lockFile;
+      home.activation.neovimLock = lib.hm.dag.entryBetween [ "linkGeneration" ] [ "writeBoundary" ] ''
+        if [[ ! -e "${lockFile}" ]]; then
+          run install -D -m 0600 "${dots}/lazy-lock.json" "${lockFile}"
+        fi
+      '';
+
+      # Preserve the earlier manual checkout intact; never overwrite a backup.
+      # On a clean machine this is a no-op, not a deployment prerequisite.
+      home.activation.neovimCheckoutBackup =
+        lib.hm.dag.entryBetween [ "linkGeneration" ] [ "writeBoundary" ]
+          ''
+            if [[ -d "${configDir}/.git" ]]; then
+              if [[ -e "${backup}" || -L "${backup}" ]]; then
+                echo "Refusing to overwrite Neovim checkout backup: ${backup}" >&2
+                exit 1
+              fi
+              run mkdir -p "$(dirname "${backup}")"
+              run mv -T "${configDir}" "${backup}"
+            fi
+          '';
+    };
+}

tools.nix

@@ -0,0 +1,14 @@
+{ pkgs, ... }:
+
+{
+  programs.git.enable = true;
+  home-manager.users.dev.programs.git = {
+    enable = true;
+    package = null; # The system module supplies Git.
+    settings.user.useConfigOnly = true;
+  };
+
+  environment.systemPackages = [
+    pkgs.nixfmt
+  ];
+}

users.nix

@@ -0,0 +1,35 @@
+{
+  users.users.dev = {
+    isNormalUser = true;
+    uid = 1001;
+    description = "Development user";
+    extraGroups = [ "wheel" ];
+    openssh.authorizedKeys.keyFiles = [ ./dev-authorized-keys ];
+  };
+
+  security.sudo.extraRules = [
+    {
+      users = [ "dev" ];
+      commands = [
+        {
+          command = "ALL";
+          options = [ "NOPASSWD" ];
+        }
+      ];
+    }
+  ];
+
+  home-manager = {
+    useGlobalPkgs = true;
+    useUserPackages = true;
+    backupFileExtension = "before-nix";
+    users.dev.home.stateVersion = "26.05";
+  };
+
+  systemd.tmpfiles.rules = [
+    "d /home/dev/.config 0755 dev users -"
+    "d /home/dev/projects 0755 dev users -"
+    # Keep the working repo editable by dev. Z does not follow store symlinks.
+    "Z /etc/nixos - dev users -"
+  ];
+}