How it works

Layout

flake.nix
lib/mkHost.nix
features/host.nix       timezone, locale, hostId
features/client.nix     which client a host belongs to
features/security.nix   baseline standard|strict, SSH keys, fail2ban
hosts/example/          sample host with placeholder hardware
check-hosts.sh          prints each host's drvPath

Decisions so far

1. One repo for now. Generic features get lifted into a public repository later, as a fresh repo, because the private history holds personal host details.
2. Typed options, not a settings attrset. Features declare nixmsp.* options. Hosts set values. Derived values are computed inside features. Bad values fail with a clear error.
3. Auto-loaded features. Features are picked up by import-tree. Add a file and it is part of every host.
4. Pure Nix for v1. No web portal and no JSON inventory.
5. Password-required sudo by default. It is set with mkDefault, so a host can opt out.
6. Clients get folders only when a real second client exists. nixmsp.client.name is the seam where per-client folders attach later.

What a host looks like

A host sets values and nothing else. This is the shape of the example host, with placeholder values:

{ ... }:
{
  nixmsp.host.timezone = "America/Los_Angeles";
  nixmsp.client.name = "example-corp";
  nixmsp.security.baseline = "standard";
}

Open questions

• Gemini-era examples pin an older nixpkgs. The scaffold uses nixos-unstable with stateVersion 25.11. That choice still needs confirming.
• Whether lifted features should live in features/ or be exported as flake nixosModules is undecided.