refactor: introduce nixos/default.nix

The system prompt addition is to make it run `npins show <pin>`
rather than `npins show` when looking for a specific pin.

`npins get-path` is mentioned because the model doesn't "know"
it yet (the subcommand was introduced in 2025 Dec).

12 files changed, 118 insertions, 50 deletions

diff --git a/AGENTS.md b/AGENTS.md
new file mode 100644
index 0000000..5391aac
--- /dev/null
+++ b/AGENTS.md
@@ -0,0 +1,40 @@
+# Agent instructions
+
+* Files in `user/` map directly to `~/.config/`. The `link-user` script creates these symlinks.
+  After creating new files in `user/`, tell me to rerun the `link-user` script.
+
+## NixOS
+
+`nixos/default.nix` is the entry point for all host configurations. It exposes:
+
+* `hostDefs`: the host definitions used to produce the other attributes.
+* `standaloneConfigurations.<host>`: the full configuration.
+* `standaloneSystems.<host>`: `standaloneConfigurations.<host>.config.system.build.toplevel`,
+  for building the final system closure.
+
+It also exposes attributes used for deployment (`configurations` and `systems`),
+which may use modules that are not available in the sandbox. Use the standalone
+attributes instead.
+
+Dependencies are pinned with npins. Each host uses one channel, which refers to
+an npins pin. The channel determines the Nixpkgs source used to evaluate the
+host configuration; its package set is passed to NixOS modules as `pkgs`.
+
+### Commands
+
+List description and channel for all hosts:
+
+    nix eval --file nixos/default.nix hostDefs
+
+Inspect and edit pins:
+
+    npins -d nixos/npins <command>
+
+To get the store path to a pin, use the `get-path` npins subcommand:
+
+    npins -d nixos/npins get-path <name>
+
+## Documentation
+
+* The Nixpkgs manual is in `<nixpkgs>/doc`.
+* The NixOS manual is in `<nixpkgs>/nixos/doc/manual`.
diff --git a/nixos/.gitignore b/nixos/.gitignore
index 06d39e8..b2be92b 100644
--- a/nixos/.gitignore
+++ b/nixos/.gitignore
@@ -1 +1 @@
-/hosts/*/result
+result
diff --git a/nixos/README.md b/nixos/README.md
index 075f812..f39917d 100644
--- a/nixos/README.md
+++ b/nixos/README.md
@@ -31,10 +31,8 @@ We're assuming that you just installed NixOS by going through the [official inst
      ```
      nixos-generate-config --dir .
      ```
-3. Rename the `configuration.nix` to `default.nix`.
-   Create a `metadata.toml` file with a `channel` field
-   where the value is the key of a channel pinned in `npins/sources.json`.
-   A new channel can be pinned with:
+3. Rename the `configuration.nix` to `hosts/<hostname>/default.nix`, then add the host to `hostDefs` in the top-level `default.nix`.
+   The channel must be a key in `npins/sources.json`. A new channel can be pinned with:
 
    ```
    nix-shell -p npins --run \
diff --git a/nixos/default.nix b/nixos/default.nix
new file mode 100644
index 0000000..e5090db
--- /dev/null
+++ b/nixos/default.nix
@@ -0,0 +1,57 @@
+let
+  sources = import ./npins;
+
+  mkConfiguration =
+    _hostName:
+    { channel, module, ... }:
+    let
+      nixpkgsPath = sources.${channel}.outPath;
+    in
+    import "${nixpkgsPath}/nixos/lib/eval-config.nix" {
+      modules = [ module ];
+      specialArgs = {
+        inherit sources nixpkgsPath;
+        configurationPath = module;
+      };
+    };
+
+  mkConfigurations =
+    selectModule: hostDefs:
+    builtins.mapAttrs (
+      hostName: hostDef: mkConfiguration hostName (hostDef // { module = selectModule hostDef; })
+    ) hostDefs;
+
+  mkSystems = builtins.mapAttrs (_: configuration: configuration.config.system.build.toplevel);
+in
+rec {
+  hostDefs = {
+    ev = {
+      description = "home server";
+      channel = "nixos-small";
+      module = ./hosts/ev/private.nix;
+      standaloneModule = ./hosts/ev/default.nix;
+    };
+
+    hamac = {
+      description = "laptop";
+      channel = "nixos";
+      module = ./hosts/hamac/private.nix;
+      standaloneModule = ./hosts/hamac/default.nix;
+    };
+
+    tente = {
+      description = "VPS";
+      channel = "nixos-small";
+      module = ./hosts/tente/default.nix;
+      standaloneModule = ./hosts/tente/default.nix;
+    };
+  };
+
+  configurations = mkConfigurations (host: host.module) hostDefs;
+
+  systems = mkSystems configurations;
+
+  standaloneConfigurations = mkConfigurations (host: host.standaloneModule) hostDefs;
+
+  standaloneSystems = mkSystems standaloneConfigurations;
+}
diff --git a/nixos/hosts/ev/metadata.toml b/nixos/hosts/ev/metadata.toml
deleted file mode 100644
index 58f0301..0000000
--- a/nixos/hosts/ev/metadata.toml
+++ /dev/null
@@ -1 +0,0 @@
-channel = "nixos-small"
diff --git a/nixos/hosts/hamac/metadata.toml b/nixos/hosts/hamac/metadata.toml
deleted file mode 100644
index fc34e27..0000000
--- a/nixos/hosts/hamac/metadata.toml
+++ /dev/null
@@ -1 +0,0 @@
-channel = "nixos"
diff --git a/nixos/hosts/tente/metadata.toml b/nixos/hosts/tente/metadata.toml
deleted file mode 100644
index 58f0301..0000000
--- a/nixos/hosts/tente/metadata.toml
+++ /dev/null
@@ -1 +0,0 @@
-channel = "nixos-small"
diff --git a/nixos/profiles/workstation/default.nix b/nixos/profiles/workstation/default.nix
index 578cece..77891fe 100644
--- a/nixos/profiles/workstation/default.nix
+++ b/nixos/profiles/workstation/default.nix
@@ -1,4 +1,13 @@
-{ config, lib, pkgs, pkgs-unstable, sources, ... }:
+{
+  config,
+  configurationPath,
+  lib,
+  nixpkgsPath,
+  pkgs,
+  pkgs-unstable,
+  sources,
+  ...
+}:
 
 let
   cfg = config.workstation;
@@ -24,9 +33,9 @@ in
   config = {
     # Makes commands default to the same Nixpkgs, config, overlays and NixOS configuration
     nix.nixPath = [
-      "nixpkgs=${toString <nixpkgs>}"
+      "nixpkgs=${toString nixpkgsPath}"
       "nixpkgs-unstable=${pkgs-unstable.path}"
-      "nixos-config=${toString <nixos-config>}"
+      "nixos-config=${toString configurationPath}"
     ];
     environment.variables.NIXPKGS_CONFIG = lib.mkForce (toString ./nixpkgs/config.nix);
 
diff --git a/nixos/profiles/workstation/llm.nix b/nixos/profiles/workstation/llm.nix
index a24a14c..a0dfc92 100644
--- a/nixos/profiles/workstation/llm.nix
+++ b/nixos/profiles/workstation/llm.nix
@@ -46,6 +46,7 @@ let
       --chdir "$physical_pwd" \
       ${pkgs-unstable.pi-coding-agent}/bin/pi \
         --append-system-prompt "You're running in a sandbox with an ephemeral root filesystem and a separate PID namespace. The current working directory and a few configuration and cache paths are mounted from the host." \
+        --append-system-prompt "$HOME/.config/pi/APPEND_SYSTEM.md" \
         "$@"
   '';
 
diff --git a/nixos/rebuild b/nixos/rebuild
index 3c675b2..395f78d 100755
--- a/nixos/rebuild
+++ b/nixos/rebuild
@@ -3,49 +3,17 @@ set -euo pipefail
 
 top=$(dirname "$(realpath "$0")")
 hostDir="$top/hosts/$HOSTNAME"
-defaultConfigPath="$hostDir/default.nix"
-privateConfigPath="$hostDir/private.nix"
 
-case "${1:-}" in
-  --default)
-    configPath="$defaultConfigPath"
-    shift
-    ;;
-  *)
-    if [ -f "$privateConfigPath" ]; then
-      configPath="$privateConfigPath"
-    else
-      configPath="$defaultConfigPath"
-    fi
-    ;;
-esac
-
-if [ ! -f "$configPath" ]; then
-  echo "aborting: $configPath doesn't exist"
+if [ ! -d "$hostDir" ]; then
+  echo "aborting: host directory $hostDir doesn't exist"
   exit 1
 fi
 
-nixpkgsPath=$(
-  cd "$top" &&
-  nix-instantiate --eval --raw \
-    --argstr host "$HOSTNAME" \
-    --expr '
-      { host }:
-      let
-        toml = builtins.readFile ./hosts/${host}/metadata.toml;
-        channel = (builtins.fromTOML toml).channel;
-      in
-      (import ./npins).${channel}.outPath
-    '
-)
-
 (
   # The result symlink created in the current directory is registered as a root of the Nix
   # garbage collector, so it's important that we call nixos-rebuild from the host directory.
   # (nix-build has an --out-link option but that option cannot be set via nixos-rebuild).
   cd "$hostDir" &&
 
-  # nixos-rebuild always reads Nixpkgs from the NIX_PATH,
-  # so we need to set it explicitly to our pinned version
-  exec nixos-rebuild "$@" --file "$top/system.nix" -I nixpkgs="$nixpkgsPath" -I nixos-config="$configPath"
+  exec nixos-rebuild "$@" --file "$top/default.nix" --attr "configurations.$HOSTNAME"
 )
diff --git a/nixos/system.nix b/nixos/system.nix
deleted file mode 100644
index a3b04cb..0000000
--- a/nixos/system.nix
+++ /dev/null
@@ -1,4 +0,0 @@
-import <nixpkgs/nixos> {
-  configuration = import <nixos-config>;
-  specialArgs.sources = import ./npins;
-}
diff --git a/user/pi/APPEND_SYSTEM.md b/user/pi/APPEND_SYSTEM.md
new file mode 100644
index 0000000..9eff0eb
--- /dev/null
+++ b/user/pi/APPEND_SYSTEM.md
@@ -0,0 +1,2 @@
+* When looking for specific information, narrow down command output via CLI
+  arguments when possible, rather than filtering the output yourself.