From a53f5823090f951daf5d1ba523a838b7b832a63a Mon Sep 17 00:00:00 2001
From: Martin Fischer <martin@push-f.com>
Date: Sun, 13 Sep 2026 14:47:11 +0200
Subject: feat(workstation): add pi

---
 nixos/profiles/workstation/default.nix |  1 +
 nixos/profiles/workstation/dev.nix     |  1 +
 nixos/profiles/workstation/llm.nix     | 69 ++++++++++++++++++++++++++++++++++
 3 files changed, 71 insertions(+)
 create mode 100644 nixos/profiles/workstation/llm.nix

(limited to 'nixos/profiles')

diff --git a/nixos/profiles/workstation/default.nix b/nixos/profiles/workstation/default.nix
index e6fc7e1..fef1757 100644
--- a/nixos/profiles/workstation/default.nix
+++ b/nixos/profiles/workstation/default.nix
@@ -19,6 +19,7 @@ in
     ./firefox.nix
     ./dev.nix
     ./create.nix
+    ./llm.nix
   ];
 
   config = {
diff --git a/nixos/profiles/workstation/dev.nix b/nixos/profiles/workstation/dev.nix
index 693e5a3..0ba131e 100644
--- a/nixos/profiles/workstation/dev.nix
+++ b/nixos/profiles/workstation/dev.nix
@@ -36,6 +36,7 @@
 
     # documentation
     man-pages # Linux development manual pages
+    bubblewrap
   ];
 
   programs.wireshark = {
diff --git a/nixos/profiles/workstation/llm.nix b/nixos/profiles/workstation/llm.nix
new file mode 100644
index 0000000..b394f71
--- /dev/null
+++ b/nixos/profiles/workstation/llm.nix
@@ -0,0 +1,69 @@
+{ pkgs, pkgs-unstable, ... }:
+
+let
+  sbox = pkgs.writeShellScriptBin "sbox" ''
+    set -euo pipefail
+
+    ${pkgs.coreutils}/bin/mkdir -p /tmp/pi "$HOME/.local/share/cargo-pi"
+
+    bwrap_args=(
+      --die-with-parent
+      --unshare-pid
+      --unshare-uts
+      --unshare-cgroup
+      --tmpfs /
+      --dev /dev
+      --proc /proc
+      --bind /tmp/pi /tmp
+      --ro-bind /etc /etc
+      --bind /nix/store /nix/store
+      --ro-bind /usr/bin/env /usr/bin/env
+      --setenv NIX_REMOTE daemon
+      --bind-try /nix/var/nix/daemon-socket /nix/var/nix/daemon-socket
+      --dir /run
+      --ro-bind-try /run/current-system /run/current-system
+      # mount git and jj config
+      --ro-bind "$HOME/.config" "$HOME/.config"
+      --ro-bind "$HOME/repos/config" "$HOME/repos/config"
+      # jj must be able to write to ~/.config/jj/repos: https://github.com/jj-vcs/jj/issues/8841
+      --overlay-src "$HOME/.config/jj" --tmp-overlay "$HOME/.config/jj"
+      --setenv CARGO_HOME "$HOME/.local/share/cargo"
+      --bind "$HOME/.local/share/cargo-pi" "$HOME/.local/share/cargo"
+    )
+
+    exec ${pkgs.bubblewrap}/bin/bwrap "''${bwrap_args[@]}" "$@"
+  '';
+
+  pi = pkgs.writeShellScriptBin "pi" ''
+    set -euo pipefail
+
+    physical_pwd="$(${pkgs.coreutils}/bin/pwd -P)"
+
+    exec ${sbox}/bin/sbox \
+      --setenv PI_CODING_AGENT_DIR "$HOME/.config/pi" \
+      --bind "$HOME/.config/pi" "$HOME/.config/pi" \
+      --bind "$physical_pwd" "$physical_pwd" \
+      --chdir "$physical_pwd" \
+      ${pkgs-unstable.pi-coding-agent}/bin/pi "$@"
+  '';
+
+  pit = pkgs.writeShellScriptBin "pit" ''
+    set -euo pipefail
+
+    tmp_cwd="$(${pkgs.coreutils}/bin/mktemp -d /tmp/pit.XXXXXX)"
+    cleanup() {
+      ${pkgs.coreutils}/bin/rmdir "$tmp_cwd" 2>/dev/null || true
+    }
+    trap cleanup EXIT
+
+    cd "$tmp_cwd"
+    exec ${pi}/bin/pi "$@"
+  '';
+in
+{
+  environment.systemPackages = [
+    sbox
+    pi
+    pit
+  ];
+}
-- 
cgit v1.3.1