feat: migrate dotfiles and harden cross-platform home config
Secrets
- Encrypt .claude.json, .docker/config.json, .duckdns via ragenix
- Register all three in secrets/secrets.nix with appropriate key sets
- Add per-app enable flags to settings/config/secrets.nix so secrets
can be toggled without code changes (duckdns off by default — Linux/server only)
- Add ragenix.homeManagerModules.default to sharedModules on both
NixOS and Darwin so age.secrets is available in HM context
home/home.nix
- Fix scripts derivation placement (was incorrectly nested inside home
block, producing home.home.packages); pull into let binding (myScripts)
and merge into top-level home.packages alongside fonts and linux packages
- Import yarn.nix
- Gate all age.secrets blocks behind lib.mkIf cfg.secrets.<x>.enable
- Gate setupDuckDNS activation on the same flag so it never runs on macOS
home/programs/zsh.nix
- Split profileExtra into cross-platform (cargo, pipx PATH) and
macOS-only (deno, homebrew, orbstack) sections via lib.optionalString
- Canonicalise hardcoded /Users/ewan paths to $HOME
home/programs/git.nix
- Guard safe.directory = "/etc/nixos" behind lib.mkIf (!pkgs.stdenv.isDarwin)
flake.nix
- Pass self and settings into mkNixOS specialArgs
- Add home-manager.backupFileExtension = "backup" for NixOS (already
present on Darwin) to prevent HM activation failure on file conflicts