Randoneering's Multi-System Nix Flake #

This flake manages my various computing environments, providing a unified way to configure different machines while allowing for necessary host-specific customizations.

The Philosophy #

My approach here is to treat each machine not as a standalone box, but as a specific instantiation of a shared, well-defined system. We pull in shared logic—like networking setups, my favorite editors, and database tooling—into central modules. Then, we apply tailored overrides in the host configuration to make each machine feel uniquely suited to its purpose.

What's in This Repository? #

This repository serves as my central configuration hub, containing:

• flake.nix: The root of the system, tying everything together.
• modules/: The shared brain. Here lives the generalized configuration for system features (like desktop, llm, database).
• home/: My digital toolkit. This handles personal settings like shell configurations, preferred programming environments (Python, Rust, etc.), and secret management via Home Manager.
• hosts/: The body of the system. These folders define what each specific machine is—the NixOS target, the hardware profile, the user context.
• secrets/: Keeping things private. Configuration data that needs to be encrypted is managed here using SOPS.

Hosts #

I've defined several specific environments for different tasks:

Environment Name	Folder	Purpose/Notes
nix-wks	hosts/wks	The primary workstation, configured for NVIDIA acceleration and local LLM serving (llama.cpp).
nix-lemur	hosts/lemur	My travel machine and one of my favorite laptops (system76 lemur pro
nix-L16	hosts/L16	My portible workstation (lenovo L16 Gen1)

Pi MCP #

Both Pi profiles use pi-mcp-adapter and explicitly disable built-in MCP. home/mcp-servers.nix defines all seven servers: Grafana, Kaneo, NixOS, Obsidian, Open Async, Sentry, and Socket. The adapter lists them in /mcp and provides a gateway plus per-server wrappers. Servers connect on demand and keep cached tool listings while idle. The default profile keeps the rpiv-todo extension for /todos.

On the laptops, activation initializes writable mcp.json and mcp-adapter.json files in both ~/.pi/agent/ and ~/.pi/agent-local/. The inventory stays in Pi-compatible mcp.json; OAuth and adapter-only options stay in mcp-adapter.json. Activation preserves existing settings and makes a mode-600 .pre-mcp-adapter backup before correcting incompatible inventory fields. Rebuild and restart Pi after changing the profile packages.

• Run /mcp or /mcp-adapter to inspect all servers.
• Run /mcp-auth grafana or /mcp-auth socket to sign in through the adapter.
• Choose Import sign-in when offered to reuse Grafana's native MCP credentials.
• Run pi-mcp-adapter doctor --json to check the default profile from the shell.
• Set PI_CODING_AGENT_DIR="$HOME/.pi/agent-local" when checking the local profile.
• Run node --test tests/unit/mcp-adapter.test.cjs to check both profiles and activation.

Pi's shell-level pi mcp commands still use native MCP and do not check adapter OAuth state.

Flake Structure #

The architecture is designed for clarity and reuse:

.
├── flake.nix
├── flake.lock
├── hosts/              # Defines specific machine instances (e.g., wks, lemur)
│   ├── nix-station/
│   ├── wks/
│   ├── lemur/
│   └── L16/
├── modules/            # Reusable system components (e.g., llm, database)
│   ├── system.nix
│   ├── desktop/
│   ├── networking/
│   ├── llm/
│   └── database/
├── home/               # User-specific configurations (e.g., programs, shell)
│   ├── core.nix
│   ├── programs/
│   ├── shell/
│   ├── languages/
│   ├── secrets.nix
│   └── utils/
├── users/              # User-specific profiles
│   ├── justin/
│   └── randoneering/
└── secrets/            # Encrypted sensitive data
    └── justin.yaml