devices.nix

@@ -13,6 +13,14 @@ in
     system = "aarch64-linux";
     nixosSystem = nixos-raspberrypi.lib.nixosInstaller;
   };
+  damocles = {
+    system = "x86_64-linux";
+    distributedBuilds.maxJobs = 0;
+  };
+  damocles-lab = {
+    system = "x86_64-linux";
+    distributedBuilds.maxJobs = 0;
+  };
   epimetheus = {
     system = "aarch64-linux";
   };

flake.lock

@@ -380,11 +380,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1782163993,
+        "lastModified": 1782083881,
-        "narHash": "sha256-qcWCmOdhM0ReI+pvYawPQPJMLyRiIc0x7lahTdn0d4c=",
+        "narHash": "sha256-pVY2svwrHDibcOFPd7Hm7DKUxgDbARAvlr3KP+chk0Q=",
         "ref": "refs/heads/main",
-        "rev": "d4dd5aad3e8b2cf2caa42faed37ea7738ad510ae",
+        "rev": "4db8a8cd3df439a06c6f5298a3ce7a46c7df1cf7",
-        "revCount": 2066,
+        "revCount": 2018,
         "type": "git",
         "url": "https://forge.darkest.space/hyperhive/hyperhive.git"
       },
@@ -1107,11 +1107,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1782164180,
+        "lastModified": 1781856186,
-        "narHash": "sha256-j8Zjk3Fqo4Jvmh2QGIJsAC0/qri1ofGpONinXOkD9SA=",
+        "narHash": "sha256-IbyvnfMnzRo9ihjC7t2CKEeEAXTAYOyQuEbVN9UNirs=",
         "owner": "vibec0re",
         "repo": "trollshell",
-        "rev": "e432379c60042df9e5aa548fee03911b573eda00",
+        "rev": "fb10a4c5b878c22d957cb7a41d90a02cad8369f2",
         "type": "github"
       },
       "original": {

nixosConfigurations/damocles-lab/default.nix

@@ -0,0 +1,16 @@
+{ pkgs, ... }:
+{
+  imports = [ ../damocles/claude-container.nix ];
+
+  services.openssh = {
+    enable = true;
+    ports = [ 2222 ];
+    # Path written into sshd_config as a string — not read at eval time.
+    # Key can be rotated without a rebuild.
+    authorizedKeysFiles = [ "/persist/damocles-ssh/id_ed25519.pub" ];
+  };
+
+  environment.systemPackages = with pkgs; [
+
+  ];
+}

nixosConfigurations/damocles/android-dev.nix

@@ -0,0 +1,43 @@
+{ pkgs, ... }:
+let
+  androidComposition = pkgs.androidenv.composeAndroidPackages {
+    buildToolsVersions = [ "36.1.0" ];
+    platformVersions = [ "35" ];
+    includeNDK = false;
+    includeEmulator = false;
+    includeSystemImages = false;
+  };
+  androidSdk = androidComposition.androidsdk;
+in
+{
+  nixpkgs.config.android_sdk.accept_license = true;
+
+  my.allowedUnfreePackages = [
+    "android-sdk-cmdline-tools"
+    "android-sdk-platform-tools"
+    "android-sdk-tools"
+    "android-sdk-build-tools"
+    "android-sdk-platforms"
+
+    # wtf
+    "platform-tools"
+    "tools"
+    "build-tools"
+    "cmdline-tools"
+    "platforms"
+    "cmake" # android sdk repackage
+  ];
+
+  environment.systemPackages = with pkgs; [
+    androidSdk
+    gradle
+    kotlin
+    jdk21
+  ];
+
+  environment.variables = {
+    ANDROID_HOME = "${androidSdk}/libexec/android-sdk";
+    ANDROID_SDK_ROOT = "${androidSdk}/libexec/android-sdk";
+    JAVA_HOME = "${pkgs.jdk21}";
+  };
+}

nixosConfigurations/damocles/claude-container.nix

@@ -0,0 +1,47 @@
+{
+  pkgs,
+  lib,
+  ...
+}:
+{
+
+  my = {
+    allowedUnfreePackages = [ "claude-code" ];
+    overlays.unstable.enable = true;
+  };
+
+  environment.systemPackages = with pkgs; [
+    unstable.claude-code
+    git
+    python3
+    coreutils-full
+    gawk
+    gnugrep
+    curl
+    bintools
+    file
+  ];
+
+  boot.isContainer = true;
+
+  programs.nix-ld = {
+    enable = true;
+    libraries = with pkgs; [
+      stdenv.cc.cc.lib
+      zlib
+    ];
+  };
+
+  # Container shares host network namespace (privateNetwork = false), so the
+  # host's tailscale already covers this. Running a second tailscaled in the
+  # same netns fights over routing and breaks connectivity after sleep/wake.
+  services.tailscale.enable = lib.mkForce false;
+  networking.firewall.checkReversePath = lib.mkForce "strict";
+
+  users.users.muede = {
+    isNormalUser = true;
+    extraGroups = [ "wheel" ];
+  };
+
+  security.sudo.wheelNeedsPassword = false;
+}

nixosConfigurations/damocles/default.nix

@@ -0,0 +1,15 @@
+{ pkgs, ... }:
+{
+  imports = [
+    ./android-dev.nix
+    ./claude-container.nix
+  ];
+
+  environment.systemPackages = with pkgs; [
+    cargo
+    rustc
+    clippy
+    gh
+    buildPackages.stdenv.cc
+  ];
+}

nixosConfigurations/muede-lpt2/containers.nix

@@ -4,31 +4,54 @@
     boot.enableContainers = true;
     virtualisation.containers.enable = true;
 
-    # containers.damocles = {
+    containers.damocles = {
-    #   autoStart = false;
+      autoStart = false;
-    #   privateNetwork = false;
+      privateNetwork = false;
-    #   path = self.nixosConfigurations.damocles.config.system.build.toplevel;
+      path = self.nixosConfigurations.damocles.config.system.build.toplevel;
-    #   bindMounts."/etc/nix/distributed-build-key" = {
+      bindMounts."/etc/nix/distributed-build-key" = {
-    #     hostPath = "/etc/nix/distributed-build-key";
+        hostPath = "/etc/nix/distributed-build-key";
-    #     isReadOnly = true;
+        isReadOnly = true;
-    #   };
+      };
-    #   bindMounts."/persist/damocles-ssh" = {
+      bindMounts."/persist/damocles-ssh" = {
-    #     hostPath = "/persist/damocles-ssh";
+        hostPath = "/persist/damocles-ssh";
-    #     isReadOnly = true;
+        isReadOnly = true;
-    #   };
+      };
-    #   bindMounts."/persist/damocles-lab" = {
+      bindMounts."/persist/damocles-lab" = {
-    #     hostPath = "/persist/damocles-lab";
+        hostPath = "/persist/damocles-lab";
-    #     isReadOnly = false;
+        isReadOnly = false;
-    #   };
+      };
-    # };
+    };
 
-    # # Global DefaultTimeoutStopSec is 10s (modern-desktop.nix), which kills systemd-nspawn
+    containers.damocles-lab = {
-    # # before it finishes halting, leaving cgroups busy and breaking restarts.
+      autoStart = false;
-    # systemd.services."container@damocles".serviceConfig = {
+      privateNetwork = false;
-    #   TimeoutStopSec = "60s";
+      path = self.nixosConfigurations.damocles-lab.config.system.build.toplevel;
-    #   # After a SIGKILL of nspawn, the kernel needs a moment to reap its cgroups.
+      bindMounts."/etc/nix/distributed-build-key" = {
-    #   # Without this, the immediate restart attempt fails with "Device or resource busy".
+        hostPath = "/etc/nix/distributed-build-key";
-    #   RestartSec = "5s";
+        isReadOnly = true;
-    # };
+      };
+      bindMounts."/workspace" = {
+        hostPath = "/persist/damocles-lab";
+        isReadOnly = false;
+      };
+      bindMounts."/persist/damocles-ssh" = {
+        hostPath = "/persist/damocles-ssh";
+        isReadOnly = true;
+      };
+    };
+
+    # Global DefaultTimeoutStopSec is 10s (modern-desktop.nix), which kills systemd-nspawn
+    # before it finishes halting, leaving cgroups busy and breaking restarts.
+    systemd.services."container@damocles".serviceConfig = {
+      TimeoutStopSec = "60s";
+      # After a SIGKILL of nspawn, the kernel needs a moment to reap its cgroups.
+      # Without this, the immediate restart attempt fails with "Device or resource busy".
+      RestartSec = "5s";
+    };
+
+    systemd.services."container@damocles-lab".serviceConfig = {
+      TimeoutStopSec = "60s";
+      RestartSec = "5s";
+    };
   };
 }