add document

.gitignore

@@ -14,3 +14,14 @@
 
 !/flake.nix
 !/flake.lock
+
+!/shells/
+!/flake/
+!/overlays/
+
+!/modules/applications/
+!/modules/hardwares/
+!/modules/profiles/
+!/modules/services/
+!/modules/systems/
+!/modules/users/

AGENTS.md

@@ -0,0 +1,28 @@
+# Repository Guidelines
+
+## Project Structure & Module Organization
+
+This repository manages NixOS and Home Manager configuration as a flake. `flake.nix` defines inputs and imports the project modules. Keep flake-level plumbing in `flake/`, reusable package overlays in `overlays/`, and development environments in `shells/`. Add configuration under the appropriate `modules/` category: `applications/`, `hardwares/`, `profiles/`, `services/`, `systems/`, or `users/`. Keep host- or user-specific choices near their owning module rather than in the root flake.
+
+## Build, Test, and Development Commands
+
+- `nix develop .#dotnix` enters the main development shell and installs the repository's pre-commit hooks.
+- `nix develop .#android` provides Android platform tools such as `adb` and `fastboot`.
+- `nix fmt` formats all supported files through treefmt.
+- `nix flake check` evaluates flake outputs and runs configured checks.
+- `pre-commit run --all-files` runs formatting, dead-code and static Nix checks, shell linting, and secret scanning.
+- `nix flake update` refreshes pinned inputs in `flake.lock`; review lockfile changes before committing.
+
+If direnv is installed, `direnv allow` activates the `dotnix` shell from `.envrc` automatically.
+
+## Coding Style & Naming Conventions
+
+Use two-space indentation in Nix files and let `nixfmt` decide layout. Prefer small modules with explicit imports and descriptive kebab-case filenames, for example `modules/services/media-server.nix`. Use camelCase for Nix attributes unless an upstream option dictates otherwise. Shell snippets must pass `shfmt` and `shellcheck`; YAML, TOML, and Markdown are formatted by the configured treefmt tools.
+
+## Testing Guidelines
+
+There is no separate unit-test suite. Before submitting changes, run `nix flake check` and `pre-commit run --all-files`. For system-specific changes, also build or evaluate the affected NixOS/Home Manager configuration without switching the live machine. Never commit generated secrets, `.age` plaintext, or local `.direnv/` state.
+
+## Commit & Pull Request Guidelines
+
+Recent history favors short, lowercase, imperative subjects such as `fix` and `update action`; automated dependency commits use `chore(deps): ...`. Prefer a specific summary that states the affected area, such as `shells: add deployment tools`. Keep commits focused. Pull requests should explain the motivation, list affected hosts or profiles, report validation commands, and note any manual migration or secret-management steps. Include screenshots only for visible desktop or application configuration changes.

README.md

@@ -0,0 +1,3 @@
+# moons14 dotfiles
+
+My NixOS + Home Manager configurations build with flake.

flake.nix

@@ -0,0 +1,112 @@
+{
+  description = "moons NixOS configurations";
+
+  inputs = {
+    # NixOS
+    nixpkgs.url = "github:NixOS/nixpkgs/nixos-26.05";
+    nixpkgs-unstable.url = "github:NixOS/nixpkgs/nixpkgs-unstable";
+
+    home-manager = {
+      url = "github:nix-community/home-manager/release-26.05";
+      inputs.nixpkgs.follows = "nixpkgs";
+    };
+
+    # Hardware / Platform
+    nixos-hardware.url = "github:NixOS/nixos-hardware/master";
+    nixos-wsl.url = "github:nix-community/NixOS-WSL";
+
+    # Desktop
+    niri-flake.url = "github:sodiboo/niri-flake";
+
+    stylix = {
+      url = "github:nix-community/stylix";
+      inputs.nixpkgs.follows = "nixpkgs";
+    };
+
+    # Terminal
+    ghostty = {
+      url = "github:moons-14/ghostty";
+    };
+
+    # Shell / Launcher
+    vicinae.url = "github:vicinaehq/vicinae";
+
+    vicinae-extensions = {
+      url = "github:vicinaehq/extensions";
+      inputs.nixpkgs.follows = "nixpkgs";
+    };
+
+    noctalia = {
+      url = "github:noctalia-dev/noctalia";
+      inputs.nixpkgs.follows = "nixpkgs";
+    };
+
+    # Editor
+    nixvim = {
+      url = "github:nix-community/nixvim/nixos-26.05";
+      inputs.nixpkgs.follows = "nixpkgs";
+    };
+
+    # Secrets management
+    sops-nix = {
+      url = "github:Mic92/sops-nix";
+      inputs.nixpkgs.follows = "nixpkgs";
+    };
+
+    # Disk management
+    disko = {
+      url = "github:nix-community/disko";
+      inputs.nixpkgs.follows = "nixpkgs";
+    };
+
+    # Boot
+    lanzaboote = {
+      url = "github:nix-community/lanzaboote";
+      inputs.nixpkgs.follows = "nixpkgs";
+    };
+
+    # Flake framework
+    flake-parts.url = "github:hercules-ci/flake-parts";
+
+    # Code formatting and git hooks
+    treefmt-nix.url = "github:numtide/treefmt-nix";
+    git-hooks-nix.url = "github:cachix/git-hooks.nix";
+
+    # Dev services
+    services-flake.url = "github:juspay/services-flake";
+
+    # LLM agents
+    llm-agents = {
+      url = "github:numtide/llm-agents.nix";
+    };
+
+    codex-desktop-linux = {
+      url = "github:ilysenko/codex-desktop-linux";
+    };
+
+    # Index / Search
+    nix-index-database = {
+      url = "github:nix-community/nix-index-database";
+      inputs.nixpkgs.follows = "nixpkgs";
+    };
+
+    # Systems
+    systems.url = "github:nix-systems/default-linux";
+  };
+
+  outputs =
+    inputs@{
+      flake-parts,
+      systems,
+      ...
+    }:
+    flake-parts.lib.mkFlake { inherit inputs; } {
+      systems = import systems;
+
+      imports = [
+        ./overlays
+        ./shells
+        ./flake
+      ];
+    };
+}

flake/default.nix

@@ -0,0 +1,6 @@
+{
+  imports = [
+    ./formatter.nix
+    ./git-hooks.nix
+  ];
+}

flake/formatter.nix

@@ -0,0 +1,48 @@
+{ inputs, ... }:
+{
+  imports = [
+    inputs.treefmt-nix.flakeModule
+  ];
+
+  perSystem =
+    { system, ... }:
+    let
+      unstable = import inputs.nixpkgs-unstable {
+        inherit system;
+        config = {
+          allowUnfree = true;
+        };
+      };
+    in
+    {
+      treefmt = {
+        projectRootFile = "flake.nix";
+
+        programs = {
+          nixfmt.enable = true;
+          deadnix.enable = true;
+          statix.enable = true;
+
+          shfmt.enable = true;
+          shellcheck.enable = true;
+
+          prettier = {
+            enable = true;
+            package = unstable.prettier;
+          };
+          yamlfmt.enable = true;
+          taplo.enable = true;
+          oxfmt.enable = true;
+        };
+
+        settings = {
+          excludes = [
+            ".git/**"
+            "*.lock"
+            ".direnv/**"
+            "*.age"
+          ];
+        };
+      };
+    };
+}

flake/git-hooks.nix

@@ -0,0 +1,43 @@
+{ inputs, ... }:
+{
+  imports = [
+    inputs.git-hooks-nix.flakeModule
+  ];
+
+  perSystem =
+    {
+      pkgs,
+      config,
+      ...
+    }:
+    {
+      pre-commit.settings = {
+        hooks = {
+          treefmt = {
+            enable = true;
+
+            package = config.treefmt.build.wrapper;
+          };
+
+          gitleaks = {
+            enable = true;
+            name = "gitleaks";
+            description = "Detect hardcoded secrets";
+
+            entry = "${pkgs.gitleaks}/bin/gitleaks dir --no-banner --redact --verbose .";
+
+            pass_filenames = false;
+
+            stages = [
+              "pre-commit"
+              "pre-push"
+            ];
+          };
+
+          deadnix.enable = true;
+          statix.enable = true;
+          shellcheck.enable = true;
+        };
+      };
+    };
+}

overlays/default.nix

@@ -0,0 +1,6 @@
+{ inputs, ... }:
+{
+  flake.overlays.default = _final: prev: {
+    llm-agents = inputs.llm-agents.packages.${prev.stdenv.hostPlatform.system};
+  };
+}

shells/android.nix

@@ -0,0 +1,15 @@
+_: {
+  perSystem =
+    { pkgs, ... }:
+    {
+      devShells.android = pkgs.mkShell {
+        packages = with pkgs; [
+          android-tools # adb, fastboot
+        ];
+
+        shellHook = ''
+          alias adb-shutter-off='adb shell settings put system csc_pref_camera_forced_shuttersound_key 0'
+        '';
+      };
+    };
+}

shells/default.nix

@@ -0,0 +1,6 @@
+{
+  imports = [
+    ./dotnix.nix
+    ./android.nix
+  ];
+}

shells/dotnix.nix

@@ -0,0 +1,35 @@
+_: {
+  perSystem =
+    {
+      pkgs,
+      config,
+      ...
+    }:
+    {
+      devShells.dotnix = pkgs.mkShell {
+        packages = [
+          config.treefmt.build.wrapper
+
+          pkgs.git
+          pkgs.gitleaks
+          pkgs.pre-commit
+
+          # sops-nix / age
+          pkgs.sops
+          pkgs.age
+          pkgs.ssh-to-age
+
+          # YubiKey for sops editing
+          pkgs.age-plugin-yubikey
+          pkgs.yubikey-manager
+          pkgs.pcsc-tools
+        ];
+
+        shellHook = ''
+          ${config.pre-commit.settings.shellHook}
+
+          export SOPS_AGE_KEY_FILE="$HOME/.config/sops/age/yubikey-identity.txt"
+        '';
+      };
+    };
+}