Dotfiles

Personal macOS and dev-pod environment setup managed with Nix, Home Manager, nix-darwin, and Kubernetes manifests.

Start Here

• AGENTS.md: repo conventions for agents and humans.
• nix/flake.nix: flake outputs for cw on macOS and vivek-dev on Linux.
• nix/home.nix: main ownership map for linked config files and packages.
• k8s/vivek-dev/: source-controlled Kubernetes resources for the GPU dev pod.

Edit files in this repo, not the live copies under $HOME. If you add, rename, or remove a managed config file, update nix/home.nix.

Mac Setup

Cheap Home Manager eval:

nix --extra-experimental-features 'nix-command flakes' eval ./nix#homeConfigurations.cw.activationPackage.drvPath

Build the full macOS system without switching:

darwin-rebuild build --flake ./nix#cw

Apply the macOS system:

darwin-rebuild switch --flake ./nix#cw

Or use the repo wrapper:

dotfiles-apply --target mac

Dev Pod

The dev pod is Deployment/default/vivek-dev on the host Kubernetes cluster. It mounts PVC/default/vivek-dev-workspace at /workspace and /root.

Entrypoints:

• k8s/vivek-dev/README.md: Kubernetes manifests and required Secrets.

Common commands:

ssh vivek-dev
kubectl diff -k k8s/vivek-dev
kubectl apply -k k8s/vivek-dev
kubectl rollout status deployment/vivek-dev -n default
kubectl scale deployment/vivek-dev -n default --replicas=0
kubectl scale deployment/vivek-dev -n default --replicas=1

Apply Home Manager inside the pod:

cd /workspace/personal/dotfiles/nix
nix build .#homeConfigurations.vivek-dev.activationPackage -o /tmp/vivek-dev-home
/tmp/vivek-dev-home/activate

From the Mac, pull the latest pushed dotfiles on the pod and apply them:

dev-pod-apply

Use dev-pod-apply --check to build on the pod without activating.

Secrets are not committed. The required secret names and recreation commands live in k8s/vivek-dev/README.md.

Paseo

The Mac runs Paseo Desktop; vivek-dev runs the daemon and agent processes. Install the desktop client with brew install --cask paseo. SSH transport needs Paseo 0.12.0 or newer; if the cask is older, use the current Apple Silicon release from https://paseo.sh/download.

In Paseo Desktop, choose Settings → Add host → Remote SSH and enter ssh://vivek-dev. It uses the existing OpenSSH alias and its Kubernetes proxy. The daemon listens only on the pod's loopback interface, with relay disabled. Use remote paths such as /workspace/personal/dotfiles when opening projects.

From the Mac terminal:

paseo-dev daemon status
paseo-dev project create /workspace/personal/dotfiles
paseo-dev ls

Home Manager links config/paseo/dev-pod.json to /root/.paseo/config.json. dev-pod-paseo installs the pinned CLI into /root/.local/share/paseo on first use. The Deployment supervises dev-pod-paseo daemon run at pod startup. For an already-running pod after applying Home Manager, start it without a pod restart:

ssh vivek-dev 'dev-pod-paseo daemon start'

Daemon state persists under /root/.paseo; worktrees live under /workspace/.paseo/worktrees. Agent credentials come from the pod's existing Claude/Codex setup.

Paseo's Claude provider uses bin/paseo-claude to select the existing claude.ai login instead of the pod API key. On this root-run pod it also removes Paseo's bypass-permission launch flags, retaining normal permission checks.

Updates

Update scripts change the repo first; apply scripts make a machine match the current repo checkout.

dotfiles-update --dry-run
dotfiles-update
dotfiles-update claude
dotfiles-update codex
dotfiles-update flake nixpkgs-unstable
dotfiles-update check

Bare dotfiles-update updates all dotfiles-managed pins and flake inputs. Review and commit the diff, push it, then run dev-pod-apply.

Repo Map

• config/nvim/: Neovim config.
• config/git/: Git config and ignore rules.
• config/zsh/: zsh entrypoints and shell config.
• config/tmux/: tmux config.
• system/: shell fragments sourced by zsh.
• bin/: personal scripts on PATH.
• nix/bootstrap.sh: fresh-machine bootstrap for macOS.
• ~/personal/agents: Shared dev-pod instructions and skills repo

SSH Commit Signing

Git signs commits with the SSH key at ~/.ssh/github. On macOS, store that key's passphrase in Keychain once:

/usr/bin/ssh-add --apple-use-keychain ~/.ssh/github

Use /usr/bin/ssh-add so the Apple Keychain flags are available even when the Nix OpenSSH package appears earlier in PATH.

New interactive shells source system/ssh.zsh, which quietly loads that key from Keychain into ssh-agent when needed. Check the agent with:

ssh-add -l

Commit Style

Use [scope]: description.

Common scopes: nix, k8s, nvim, zsh, git, claude, skills, clean.