archetypes

The Allod VM framework. This repo composes NixOS and Home Manager configurations for every machine archetype (dev, privacy, hypervisor) from the framework repos (vm, nexus), the machine profile definitions in the profiles input, and the consumer-owned inventory and secrets data. It builds a synthetic example fleet as-is; a deploy flake redirects profiles, inventory, and secrets at an operator's own repos to build real machines.

This repo was named profiles until it was renamed to archetypes — see History.

Ownership

This repo owns:

• the archetype set and the per-archetype builders (mkDevVm, mkPrivacyVm, mkHypervisor)
• profile-definition composition (composeProfileDefinitions) and the unknown-archetype, missing-definition, and override-collision guards
• shared framework modules under modules/ (agent tooling, credentials, netrc, the shared home modules)
• the vmFacts derivation and the nixosConfigurations / checks outputs

This repo does not own:

• machine profile definitions (which modules compose each machine), the per-machine profileData, and the preferences module: profiles
• VM framework modules, disk layout, or base guest policy: vm
• hypervisor framework modules and lifecycle scripts: nexus
• machine inventory, VM specs, repository registry, IPs, MACs, and platforms: inventory
• identity data, credential inventory, Forge hosts/users, token paths, and git policy data: secrets

The profiles input

The framework reads machine profile definitions from a single profiles input: profiles.lib.profileDefinitions (per-archetype module lists), profiles.lib.profileData (optional per-machine builder overrides), and profiles.homeModules.preferences. The public example allod/profiles repo ships synthetic definitions; a deploy flake redirects this input at an operator's own definitions repo exporting the same contract. Archetype-name validity and the composition guards live here, the framework being the fact's owner.

Exports

• nixosConfigurations — the example fleet, composed from this flake's own locked inputs.
• vmFacts — provisioning facts read host-side by nexus as <flake>#vmFacts.
• profilesSource — the store path of the profiles input actually composed with.
• lib.composeProfileDefinitions { base, overlay } — merge two definition layers, enforcing the override-collision rule; for a profiles repo that layers its own machines onto the public examples.
• lib.composedLayerCheck { pkgs, expectedProfiles } — a canary derivation that fails when a deploy flake's profiles redirect is lost (composed profiles ≠ the profiles the deploy pins).

Common commands

nix flake check
nix build .#nixosConfigurations.nexus.config.system.build.toplevel --no-link

Provisioning, rebuild, token rotation, and VM SSH host-key commands are hypervisor-side and owned by nexus.

History

This repo was allod/profiles until it was renamed to allod/archetypes; the example machine definitions it used to carry moved to a new allod/profiles repo with fresh history. All pre-rename commits remain fetchable at the allod/archetypes URL — renames only, no history rewrite. A historical deploy lock that pins an allod/profiles framework revision no longer resolves cold once the new definitions repo claims that name; re-resolve it by overriding the input URL:

--override-input <name> "git+https://forge.anarch.diy/allod/archetypes.git?rev=<rev>"