dendritic

Dendritic-pattern master flake for my machines, replacing ~/.config/home-manager-v3. Every file under modules/ is a top-level flake-parts module, auto-registered by import-tree — see the dendritic pattern.

Hosts

Host	System	Desktop	Notes
NIXPC	x86_64-linux	MangoWM + Noctalia Shell	NVIDIA GPU, gaming (Steam bundle + tools), MCP containers
ASAHI	aarch64-linux	Niri + Noctalia Shell	Apple Silicon via nixos-apple-silicon, Widevine DRM Firefox

Rebuild

# NIXPC
sudo nixos-rebuild switch --impure --flake ~/.config/dendritic#NIXPC

# ASAHI
sudo nixos-rebuild switch --impure --flake ~/.config/dendritic#ASAHI

--impure is required: on the target machine the core module consumes /etc/nixos/hardware-configuration.nix (which stays out of this repo by design). Evaluated anywhere else, hosts fall back to a placeholder root filesystem — evaluation still succeeds, deploys only happen from the machine itself.

Features

One directory per app/concern under modules/features/. Import IS enabling: NixOS-scoped features export flake.nixosModules.<name>, home-manager-scoped ones export flake.homeManagerModules.<name>; host presets and the HM glue wire them up.

Feature	What importing it enables
act	GitHub Actions local runner via nektos/act; composes docker, ships a default runner image in ~/.actrc. Enabled by the desktop bundle
computer-use	Wayland desktop-control toolchain: grim, slurp, wtype, wlrctl, wlr-randr, wayland-utils. Enabled by the desktop bundle
davinci	DaVinci Resolve (from the davinci input)
docker	Docker runtime + compose CLI; sibling module mcpContainers provisions the omp MCP stack (scrapling :8000, agentwebsearch-mcp :8902, hindsight host-networked) as systemd-managed oci-containers
fish	fish shell config + companion CLI tools (direnv hook comes from programming)
gaming-tools	Lutris, MangoHud, Wine, Vulkan tooling and friends — beyond Steam
ghostty	Ghostty terminal with live-editable out-of-store config
lazygit	lazygit built by this flake, into environment.systemPackages
leetcode	LeetCode runner (kawre/leetcode.nvim) inside nvf: fzf-lua picker + plenary/nui/devicons bundled, <leader>l* bindings, login via :Leet cookie update
mango	MangoWM session + its home-manager user config
niri	Niri compositor + session, live-editable config.kdl
nautilus	Nautilus file manager (replaces Thunar) plus gvfs, and the default handler for inode/directory. Enabled by the desktop bundle
nixpc-desktop	NIXPC desktop application suite (browsers, media, utilities)
noctalia	Noctalia desktop shell v5 (bars, panels, launcher, lock screen); settings are per-host. Includes the cernoh/terminal panel plugin and its ghostty-term helper (libghostty-vt)
noctalia-greeter	greetd login UI matching Noctalia; each host picks --session <compositor> inline
nushell	nushell as secondary interactive shell, incl. nixpc-rebuild / asahi-rebuild helpers
nvf	Neovim via nvf (languages, keymaps, nixd config)
omp	Oh My Pi agent CLI via overlay (overlays.omp, packages.omp); ~/.omp symlinked out-of-store
opencode	OpenCode agent CLI config tree, out-of-store
posy-cursors	Posy cursor themes
programming	Dev environment: git, direnv, tmux, zellij, gh, editors' companions
scheme	The flake-wide sepia palette: roles, base16, ANSI, the Noctalia palette document, the greeter palette, the omp theme, and the host wallpaper. Every themed feature reads this
sober	Roblox via Sober (flatpak org.vinegarhq.Sober); composes flatpak + portals, installs the app on the first switch (needs flathub)
steam	programs.steam + protontricks + compat packages
stremio-kai	Stremio-Kai mpv configuration copied writable into ~/.config/mpv
stylix	GTK and Qt theming from the sepia palette through stylix: GTK CSS + adw-gtk3, and a Kvantum theme. Only the gtk and qt targets are on. Enabled by the desktop bundle
usb-automount	udev-triggered USB mounting under /run/media/<user> with mount/unmount notifications
wayland-base	Qt Wayland platforms, Chromium/Electron ozone flags, Firefox Wayland, fuzzel
widevine	Widevine DRM-enabled Firefox (aarch64 — without it Netflix-class playback breaks on Asahi)

Layout

modules/
  parts.nix           shared flake-parts plumbing: systems list, output-option declarations
  attrs/              machine-class bundles composing features by name
    desktop/            core + network + audio + usb-automount + home-manager glue
    gaming/             the Steam + Sober bundle
    programming/        system-side dev tools (HM side comes from the programming feature)
  features/<app>/     opt-in feature modules (the table above)
  hosts/<HOST>/       host presets producing nixosConfigurations.<HOST>
  system/             cross-host system concerns: core, network, audio, drivers, home-manager glue

Conventions:

• Auto-registration: every file under modules/ is imported as a flake-parts module — no manifest. Corollary: a parse error in any file breaks the whole flake; check new files with nix-instantiate --parse <file>.
• _ exclusion: paths containing /_ are skipped by import-tree. Data-only siblings (_languages.nix, host settings files, _*.pkg.nix derivations) use it and are imported explicitly by their owning module.
• Lower-level modules are values: features store NixOS/HM modules under flake.nixosModules.* / flake.homeManagerModules.*; hosts assemble them by name.
• Out-of-store symlinks: configs meant to stay live-editable (fish, nvf, niri, ghostty, omp, opencode) link back into this checkout instead of living in the store.

Verification ladder

Cheapest first; stop at the rung that covers your change:

1. Parse: nix-instantiate --parse <file>
2. Targeted evals: nix eval .#nixosConfigurations.<HOST>.config.<option> (also homeManagerModules renders, rendered artifacts under nix eval ... config.system.build.toplevel.drvPath)
3. Rendered-artifact checks: read generated files out of evaluated derivations
4. Whole flake: nix flake check --impure

Automated via Nix module modules/verify.nix (replaces the former scripts/verify.sh):

nix flake check --impure              # all gates as checks: parse, eval-pure, hardware, fmt, verify
nix run .#verify                      # same gates, run outside sandbox so impure hardware sees real /etc/nixos
nix run .#verify -- --host ASAHI      # only ASAHI (also --hosts, --system, --systems)
nix run .#verify -- --system aarch64-linux  # only aarch64-linux hosts
nix build .#checks.aarch64-linux.verify-parse     # single gate
nix build .#checks.aarch64-linux.verify-hardware  # hardware gate only

Gate 3 is the hardwareFromMachine gate from modules/system/core/default.nix: on the native machine --impure must consume /etc/nixos/hardware-configuration.nix (no placeholder warning, fileSystems."/" is by-uuid not by-label); cross-machine evals must stay placeholder. The Nix module auto-detects currentSystem and fails with the fix (sudo rm /etc/nixos if dangling symlink, then restore from /etc/nixos.backup.* or nixos-generate-config) when the gate is violated. In CI/sandbox (CI=1 or NIX_BUILD_TOP) placeholder is expected for all hosts.

CI (.github/workflows/) runs a changed-file nixfmt check, an eval matrix over both hosts, and a weekly flake-lock bump.

Known boundaries

• hardware-configuration.nix stays out of the repo by design — root/boot come from the machine's /etc/nixos/hardware-configuration.nix at deploy time (see Rebuild above).
• Cross-machine evaluation shows a hardwareFromMachine … placeholder root filesystem warning; that is the documented boundary above, not a bug.
• Asahi inputs must follow nixpkgs (inputs.nixpkgs.follows = "nixpkgs"): apple-silicon support modules inject packages into host configs, and without the follow they resolve against the input's own eval system and break ASAHI evals from other machines (#16).
• Noctalia inputs must not follow nixpkgs (#179): upstream builds the shell and the greeter against its own locked nixpkgs and publishes them to noctalia.cachix.org. A follow changes every store path, so Nix substitutes nothing and compiles both packages locally. The shell tracks the upstream cachix branch, which always points at the newest cached commit; the greeter tracks main, so a bump to a commit CI has not built yet costs one local build.
• Asahi bootchain builds locally: tpwrules/nixos-apple-silicon publish no binary cache for linux-asahi/uboot-asahi/m1n1 (nixos-apple-silicon.cachix.org covers everything else), so every asahi input bump rebuilds the ~4 heavy bootchain derivations on the Mac (issue #73). Plan for it: reboot after a bump (/run/reboot-required banner, issue #72) and follow the rescue runbook in modules/hosts/ASAHI/RESCUE.md when rolling back.