# Profiles

Profiles are host-selectable compositions of independently owned units. They
describe why a group of units is enabled; application, service, system, and
hardware configuration remains in its owning unit.

## Layers

| Namespace    | Purpose                                                 | Compatibility   |
| ------------ | ------------------------------------------------------- | --------------- |
| `base`       | Invariants required by every host                       | NixOS and macOS |
| `interface`  | Command-line and graphical ways to operate a host       | Per-profile     |
| `platform`   | NixOS foundation and physical or virtual hardware shape | NixOS           |
| `workload`   | Optional activities performed on a host                 | Per-profile     |
| `networking` | Network roles and topology                              | Per-profile     |
| `security`   | Optional security and secret-management policies        | Per-profile     |

`base` contains the shared Nix foundation plus the universally available CLI
tools (Atuin, tealdeer, trippy, and xh). A unit belongs there only when it is
required on every supported host.

## Compatibility

| Profile                              | Supported host class                          |
| ------------------------------------ | --------------------------------------------- |
| `base`                               | NixOS, macOS                                  |
| `interface.cli`                      | NixOS, macOS with Home Manager                |
| `interface.gui`                      | NixOS, macOS with Home Manager                |
| `interface.macos`                    | macOS                                         |
| `interface.linux-desktop`            | NixOS with Home Manager                       |
| `interface.labwc`                    | NixOS with Home Manager                       |
| `interface.niri`                     | NixOS with Home Manager                       |
| `platform.nixos`                     | NixOS                                         |
| `platform.desktop`                   | Physical NixOS desktop                        |
| `platform.intel-nvidia-desktop`      | Intel/NVIDIA physical NixOS desktop           |
| `platform.laptop`                    | Physical NixOS laptop                         |
| `platform.thinkpad-x1`               | Intel ThinkPad X1 running NixOS               |
| `platform.vm`                        | UEFI QEMU NixOS guest with NFS client support |
| `workload.deploy-rs-target`          | NixOS                                         |
| `workload.development`               | NixOS, macOS with Home Manager                |
| `workload.game`                      | NixOS, macOS                                  |
| `workload.machine-learning`          | NixOS with Home Manager                       |
| `workload.personal`                  | NixOS, macOS with Home Manager                |
| `workload.remote-access`             | NixOS, macOS                                  |
| `workload.camera`                    | NixOS                                         |
| `workload.server`                    | NixOS, macOS with Home Manager                |
| `networking.tailscale-client`        | NixOS, macOS                                  |
| `networking.tailscale-subnet-router` | NixOS                                         |
| `security.fingerprint`               | NixOS, macOS                                  |
| `security.secrets`                   | NixOS, macOS                                  |
| `security.secure-boot`               | NixOS                                         |
| `security.tpm-storage`               | NixOS with a host-defined LUKS device         |

Select independent concerns independently in `hosts/default.nix`. For example,
a NixOS desktop can combine `interface.labwc` and `interface.niri` to provide
both sessions while sharing `interface.linux-desktop` and `interface.gui`.
The shared Linux desktop profile provides the common desktop applications and
session-independent services; both session profiles select ly. The laptop
platform selects niri as Ly's default session, while the desktop platform
selects labwc. A daily-use macOS development machine can combine
`interface.macos`, `workload.development`, and `workload.personal`. Hardware
support does not implicitly select an interface or workload.

`workload.machine-learning` provides the Hugging Face Hub CLI for hosts used
to download and publish machine learning models and datasets.

`workload.deploy-rs-target` enables OpenSSH and provisions the `nixdeploy`
service account with the narrowly scoped passwordless commands required for
deploy-rs activation and rollback confirmation.

`workload.personal` provides Pear Desktop on both NixOS and macOS. Home Manager
enables performance improvements, synced lyrics, tracker blocking, the album
color theme, and custom output-device selection while preserving user-owned
settings such as the selected device.

`workload.personal` provides ActivityWatch for local activity tracking. On
NixOS, its server and Wayland-compatible watcher run as Home Manager user
services. On macOS, the Homebrew cask starts at login.

On NixOS, `workload.game` provides Steam with Valve Proton and Proton-GE,
Protontricks, Wayland-compatible Steam Input, GameMode, Gamescope, and MangoHud.
Enabling Steam also activates the 32-bit graphics and PipeWire support required
by older games. On macOS the same profile currently provides the portable game
applications that support that host class.

`security.tpm-storage` deliberately does not own a disk identifier. A host that
selects it must define `boot.initrd.luks.devices.cryptroot.device` in its
machine-specific NixOS module.