refactor(hosts): separate nixos and system-manager hosts

Assisted-by: pi (gpt-5.6-sol)

.gitattributes

@@ -1,4 +1,3 @@
-nixos/hosts/*/secrets/*.yaml diff=sopsdiffer
-nixos/common/secrets/*.yaml diff=sopsdiffer
+hosts/nixos/**/secrets.yaml diff=sopsdiffer
 home/gabriel/**/*/*.yaml diff=sopsdiffer
 nix linguist-generated=true

.sops.yaml

@@ -12,32 +12,32 @@ keys:
     - &maia age150kp4hx4qzfpcxayyfh8xcv8nf0uudppsknwgzgj724djqup2qvqz2gwj5
     - &pleione age1mhlh8lj8jv58xy9mdhsarfyanckyx8c2xdu09xrn23nrc56e94xserztxx
 creation_rules:
-  - path_regex: hosts/taygeta/secrets.ya?ml$
+  - path_regex: hosts/nixos/taygeta/secrets.ya?ml$
     key_groups:
     - age:
       - *taygeta
       pgp:
       - *misterio
-  - path_regex: hosts/celaeno/secrets.ya?ml$
+  - path_regex: hosts/nixos/celaeno/secrets.ya?ml$
     key_groups:
     - age:
       - *celaeno
       pgp:
       - *misterio
-  - path_regex: hosts/alcyone/secrets.ya?ml$
+  - path_regex: hosts/nixos/alcyone/secrets.ya?ml$
     key_groups:
     - age:
       - *alcyone
       pgp:
       - *misterio
-  - path_regex: hosts/merope/secrets.ya?ml$
+  - path_regex: hosts/nixos/merope/secrets.ya?ml$
     key_groups:
     - age:
       - *merope
       pgp:
       - *misterio
 
-  - path_regex: hosts/common/.*secrets.ya?ml$
+  - path_regex: hosts/nixos/common/.*secrets.ya?ml$
     key_groups:
     - age:
       - *atlas

AGENTS.md

@@ -64,15 +64,17 @@ Update website from f6c09b0b to 70386bb7 (2 commits, docs-only):
 │   ├── global/            #   Always-imported config (xdg, etc.)
 │   ├── {hostname}.nix     #   Per-host home-manager config
 │   └── generic.nix        #   Non-impermanence fallback
-├── hosts/                 # NixOS host configs
-│   ├── common/            #   Shared across hosts
-│   │   ├── global/        #     Always-imported
-│   │   ├── optional/      #     Opt-in modules
-│   │   └── secrets.yaml   #     SOPS-encrypted shared secrets
-│   └── {hostname}/        #   Per-host (atlas, maia, alcyone, celaeno, merope, pleione, taygeta)
-│       ├── default.nix    #     NixOS module
-│       ├── hardware-configuration.nix
-│       └── secrets.yaml   #     Host-specific secrets (optional)
+├── hosts/
+│   ├── nixos/             # NixOS host configs
+│   │   ├── common/        #   Shared across hosts
+│   │   │   ├── global/    #     Always-imported
+│   │   │   ├── optional/  #     Opt-in modules
+│   │   │   └── secrets.yaml #   SOPS-encrypted shared secrets
+│   │   └── {hostname}/    #   Per-host (atlas, maia, alcyone, celaeno, merope, pleione, taygeta)
+│   │       ├── default.nix #    NixOS module
+│   │       ├── hardware-configuration.nix
+│   │       └── secrets.yaml #   Host-specific secrets (optional)
+│   └── system-manager/    # Non-NixOS System Manager host configs
 ├── modules/               # Custom NixOS & HM modules
 │   ├── nixos/
 │   └── home-manager/
@@ -109,8 +111,8 @@ Update website from f6c09b0b to 70386bb7 (2 commits, docs-only):
 
 - Managed with **sops-nix**, keys defined in `.sops.yaml`.
 - Two types of secret files:
-  - `hosts/common/secrets.yaml` -- shared across hosts, encrypted to all host age keys.
-  - `hosts/{hostname}/secrets.yaml` -- per-host, encrypted to that host only.
+  - `hosts/nixos/common/secrets.yaml` -- shared across hosts, encrypted to all host age keys.
+  - `hosts/nixos/{hostname}/secrets.yaml` -- per-host, encrypted to that host only.
 - Both are also encrypted to the PGP key `7088C7421873E0DB97FF17C2245CAB70B4C225E9`. It lives on misterio's yubikey.
 - **Never** read secrets into context. Ask the user to do it.
 

README.md

@@ -12,7 +12,8 @@ Looking for something simpler to start out with flakes? Try [my starter config r
 ## Repository layout
 
 ```text
-hosts/          per-machine NixOS configurations (atlas, alcyone, ...)
+hosts/nixos/   per-machine NixOS configurations (atlas, alcyone, ...)
+hosts/system-manager/ configurations for non-NixOS Linux systems
 home/           home-manager configuration (feature-flagged)
 modules/        reusable nixos/ and home-manager/ modules
 overlays/, pkgs/ package overlays and custom packages (including wallpapers)

flake.nix

@@ -100,49 +100,49 @@
     nixosConfigurations = {
       # Main desktop
       atlas = lib.nixosSystem {
-        modules = [./hosts/atlas];
+        modules = [./hosts/nixos/atlas];
         specialArgs = {
           inherit inputs outputs;
         };
       };
       # Living room desktop
       pleione = lib.nixosSystem {
-        modules = [./hosts/pleione];
+        modules = [./hosts/nixos/pleione];
         specialArgs = {
           inherit inputs outputs;
         };
       };
       # Personal laptop (Framework 13)
       maia = lib.nixosSystem {
-        modules = [./hosts/maia];
+        modules = [./hosts/nixos/maia];
         specialArgs = {
           inherit inputs outputs;
         };
       };
       # Core server (Vultr)
       alcyone = lib.nixosSystem {
-        modules = [./hosts/alcyone];
+        modules = [./hosts/nixos/alcyone];
         specialArgs = {
           inherit inputs outputs;
         };
       };
       # Build and game server (Oracle)
       celaeno = lib.nixosSystem {
-        modules = [./hosts/celaeno];
+        modules = [./hosts/nixos/celaeno];
         specialArgs = {
           inherit inputs outputs;
         };
       };
       # Build and game server (Magalu Cloud)
       taygeta = lib.nixosSystem {
-        modules = [./hosts/taygeta];
+        modules = [./hosts/nixos/taygeta];
         specialArgs = {
           inherit inputs outputs;
         };
       };
       # Media server (RPi)
       merope = lib.nixosSystem {
-        modules = [./hosts/merope];
+        modules = [./hosts/nixos/merope];
         specialArgs = {
           inherit inputs outputs;
         };

hosts/nixos/alcyone/services/website/default.nix

@@ -1,7 +1,7 @@
 {pkgs, ...}: let
   website = pkgs.website;
-  pgpKey = ../../../../home/gabriel/pgp.asc;
-  sshKey = ../../../../home/gabriel/ssh.pub;
+  pgpKey = ../../../../../home/gabriel/pgp.asc;
+  sshKey = ../../../../../home/gabriel/ssh.pub;
   redir = {
     forceSSL = true;
     enableACME = true;

hosts/nixos/common/users/gabriel/default.nix

@@ -51,7 +51,7 @@ in {
       "wireshark"
     ];
 
-    openssh.authorizedKeys.keys = lib.splitString "\n" (builtins.readFile ../../../../home/gabriel/ssh.pub);
+    openssh.authorizedKeys.keys = lib.splitString "\n" (builtins.readFile ../../../../../home/gabriel/ssh.pub);
     hashedPasswordFile = config.sops.secrets.gabriel-password.path;
     packages = [pkgs.home-manager];
   };
@@ -71,7 +71,7 @@ in {
     };
   };
 
-  home-manager.users.gabriel = import ../../../../home/gabriel/${config.networking.hostName}.nix;
+  home-manager.users.gabriel = import ../../../../../home/gabriel/${config.networking.hostName}.nix;
 
   systemd.services.home-manager-gabriel.serviceConfig.ExecStart = lib.mkForce activateHomeForTime;