Move the builders out of flake.nix #98

New issue

Closed

opened 2026-09-22 01:31:14 +01:00 by allod-agent · 0 comments

allod-agent commented

2026-09-22 01:31:14 +01:00

Member

Finish what allod/archetypes#93 started: the three builders move out of flake.nix into nix/builders/, so the flake is the inputs, the composition and the exports, and a change to one builder renders as a change to that builder's file.

Primary goals:

flake.nix is composition only — after allod/archetypes#93 it is 777 lines, and the three builders are 380 of them; what remains after this is inputs, the profile-definition merge, machineConfigurations, the outputs and the exports.
One file per builder — nix/builders/dev.nix, privacy.nix and hypervisor.nix, each a function of the flake inputs it uses, with the shared module list beside them.
A pure move — every machine's toplevel derivation path and every check's derivation path is unchanged, which is the same gate allod/archetypes#93 used and the same capture script proves it.
Sequenced against the signature change — allod/archetypes#92 changes what the builders take; this issue changes where they live. They do not land in one PR.

Current state and specifics

Line numbers are for the tree after allod/archetypes#93 lands (PR allod/archetypes#96). mkDevVm is flake.nix:239-452, mkPrivacyVm is :453-480, mkHypervisor is :481-601, and sharedModules and guestModuleFor (:86-112) are what all three compose from. memoryTraceModules (:234) and mkGithubCredentialModule (:228) are dev-builder helpers. The secretsInput shadowing trick (:222) exists so a builder argument can shadow the input; a builder in its own file takes secrets as an ordinary argument and the trick becomes unnecessary, but removing it is a change to the seam allod/archetypes#92 is about, so the move keeps it and #92 decides.

Ordering is a trigger, not a date: whichever of this issue and allod/archetypes#92 opens its PR first lands first, and the other rebases onto it. A move over unchanged signatures and a signature change over unmoved files are each readable; one diff that does both is not.

Scope

In scope: the three builders, the shared module list and the two dev-builder helpers, and the builders attribute set that names them.

Explicitly not in scope: the builder signatures (allod/archetypes#92) and machineConfigurations, which is the composition and stays.

Refs allod/archetypes#93, allod/archetypes#92

Finish what allod/archetypes#93 started: the three builders move out of `flake.nix` into `nix/builders/`, so the flake is the inputs, the composition and the exports, and a change to one builder renders as a change to that builder's file. Primary goals: - **`flake.nix` is composition only** — after allod/archetypes#93 it is 777 lines, and the three builders are 380 of them; what remains after this is inputs, the profile-definition merge, `machineConfigurations`, the outputs and the exports. - **One file per builder** — `nix/builders/dev.nix`, `privacy.nix` and `hypervisor.nix`, each a function of the flake inputs it uses, with the shared module list beside them. - **A pure move** — every machine's toplevel derivation path and every check's derivation path is unchanged, which is the same gate allod/archetypes#93 used and the same capture script proves it. - **Sequenced against the signature change** — allod/archetypes#92 changes what the builders take; this issue changes where they live. They do not land in one PR. ### Current state and specifics Line numbers are for the tree after allod/archetypes#93 lands (PR allod/archetypes#96). `mkDevVm` is `flake.nix:239-452`, `mkPrivacyVm` is `:453-480`, `mkHypervisor` is `:481-601`, and `sharedModules` and `guestModuleFor` (`:86-112`) are what all three compose from. `memoryTraceModules` (`:234`) and `mkGithubCredentialModule` (`:228`) are dev-builder helpers. The `secretsInput` shadowing trick (`:222`) exists so a builder argument can shadow the input; a builder in its own file takes `secrets` as an ordinary argument and the trick becomes unnecessary, but removing it is a change to the seam allod/archetypes#92 is about, so the move keeps it and #92 decides. Ordering is a trigger, not a date: whichever of this issue and allod/archetypes#92 opens its PR first lands first, and the other rebases onto it. A move over unchanged signatures and a signature change over unmoved files are each readable; one diff that does both is not. ### Scope In scope: the three builders, the shared module list and the two dev-builder helpers, and the `builders` attribute set that names them. Explicitly not in scope: the builder signatures (allod/archetypes#92) and `machineConfigurations`, which is the composition and stays. Refs allod/archetypes#93, allod/archetypes#92

allod-agent referenced this issue from a commit

2026-09-22 01:49:59 +01:00

Move the three builders out of flake.nix into nix/builders/

allod-agent referenced this issue from a commit

2026-09-22 01:49:59 +01:00

Fix two comments the move made false

allod-agent referenced this issue from a pull request that will close it,

2026-09-22 02:20:12 +01:00

Move the builders out of flake.nix into nix/builders/ #99