dotfiles/modules/profiles/README.md

Profiles

Profiles are host-selectable compositions of independently owned units. They describe why a group of units is enabled; application, service, system, and hardware configuration remains in its owning unit.

Layers

Namespace	Purpose	Compatibility
base	Invariants required by every host	NixOS and macOS
interface	Command-line and graphical ways to operate a host	Per-profile
platform	NixOS foundation and physical or virtual hardware shape	NixOS
workload	Optional activities performed on a host	Per-profile
networking	Network roles and topology	Per-profile
security	Optional security and secret-management policies	Per-profile

base contains the shared Nix foundation plus the universally available CLI tools (Atuin, tealdeer, trippy, and xh). A unit belongs there only when it is required on every supported host.

Compatibility

Profile	Supported host class
base	NixOS, macOS
interface.cli	NixOS, macOS with Home Manager
interface.gui	NixOS, macOS with Home Manager
interface.macos	macOS
interface.linux-desktop	NixOS with Home Manager
interface.labwc	NixOS with Home Manager
interface.niri	NixOS with Home Manager
platform.nixos	NixOS
platform.desktop	Physical NixOS desktop
platform.intel-nvidia-desktop	Intel/NVIDIA physical NixOS desktop
platform.laptop	Physical NixOS laptop
platform.thinkpad-x1	Intel ThinkPad X1 running NixOS
platform.vm	UEFI QEMU NixOS guest with NFS client support
workload.deploy-rs-target	NixOS
workload.development	NixOS, macOS with Home Manager
workload.game	NixOS, macOS
workload.machine-learning	NixOS with Home Manager
workload.personal	NixOS, macOS with Home Manager
workload.remote-access	NixOS, macOS
workload.camera	NixOS
workload.server	NixOS, macOS with Home Manager
networking.tailscale-client	NixOS, macOS
networking.tailscale-subnet-router	NixOS
security.fingerprint	NixOS, macOS
security.secrets	NixOS, macOS
security.secure-boot	NixOS
security.tpm-storage	NixOS with a host-defined LUKS device

Select independent concerns independently in hosts/default.nix. For example, a NixOS desktop can combine interface.labwc and interface.niri to provide both sessions while sharing interface.linux-desktop and interface.gui. The shared Linux desktop profile provides the common desktop applications and session-independent services; both session profiles select ly. The laptop platform selects niri as Ly's default session, while the desktop platform selects labwc. A daily-use macOS development machine can combine interface.macos, workload.development, and workload.personal. Hardware support does not implicitly select an interface or workload.

workload.machine-learning provides the Hugging Face Hub CLI for hosts used to download and publish machine learning models and datasets.

workload.deploy-rs-target enables OpenSSH and provisions the nixdeploy service account with the narrowly scoped passwordless commands required for deploy-rs activation and rollback confirmation.

workload.personal provides Pear Desktop on both NixOS and macOS. Home Manager enables performance improvements, synced lyrics, tracker blocking, the album color theme, and custom output-device selection while preserving user-owned settings such as the selected device.

workload.personal provides ActivityWatch for local activity tracking. On NixOS, its server and Wayland-compatible watcher run as Home Manager user services. On macOS, the Homebrew cask starts at login.

On NixOS, workload.game provides Steam with Valve Proton and Proton-GE, Protontricks, Wayland-compatible Steam Input, GameMode, Gamescope, and MangoHud. Enabling Steam also activates the 32-bit graphics and PipeWire support required by older games. On macOS the same profile currently provides the portable game applications that support that host class.

security.tpm-storage deliberately does not own a disk identifier. A host that selects it must define boot.initrd.luks.devices.cryptroot.device in its machine-specific NixOS module.