Phase 1 of the incus-pet design. Adds the deployment infrastructure
under modules/nixos/linux/incus/ — a CLI, a container-essentials NixOS
module, a SKILL.md for agent-driven adoption — and deletes the webapps/
tree (nspawn-based, weaker isolation defaults, no live consumers).
Pairs with srid/anywhen#15 (nixosModules.incus on the anywhen flake)
for end-to-end deployment of anywhen as an incus container.
Surface added:
- modules/nixos/linux/incus/container.nix container essentials
(sshd, hostname, flakes, firewall, base packages); imported by the
marshaling flake incus-pet generates per app
- modules/nixos/linux/incus/incus-pet/ CLI tree:
default.nix writeShellApplication; subcommands deploy/list/rm
SKILL.md 3-branch agent recipe (deploy / wrapper / add
contract upstream)
README.md human docs with the full network-model section
- modules/flake-parts/incus-pet.nix exposes packages.incus-pet
Surface removed:
- modules/nixos/linux/anywhen.nix anywhen runs as a
container now, not as a host-installed service
- configurations/nixos/pureintent drops the anywhen import
and the services.anywhen.host wiring
- webapps/ deleted entirely
Port convention: every containerized service binds 8080 inside its
own netns. The host-side <listen-ip>:<host-port> is unique per app,
chosen at first deploy via --port + --listen (or INCUS_PET_LISTEN
env), and recorded in container metadata so re-deploys are flagless.
Run:
nix run .#incus-pet -- deploy github:srid/anywhen \
--port 7700 --listen 100.122.32.106
See modules/nixos/linux/incus/incus-pet/README.md for the operator
flow and the network model in full.
* docs: Ralph report scaffolding + pureintent eval baseline (10.87s)
* cycle-1: drop nixvim — pureintent eval 10.87s → 6.98s (-36%)
nixvim's home-manager module system is by far the dominant cost of
evaluating `nixosConfigurations.pureintent`: a profile of selective
imports puts it at 3.97s of the 10.87s baseline (~36%).
Replace it with a minimal `programs.neovim.enable = true` configuration.
The runtime behaviour of `nvim` changes (no plugins, no LSP, no
mapleader/telescope/treesitter/etc.) — accepted by the user.
Measured on srid-nc (nixos, 6.12.85 kernel), 7 warm-cache runs with
`--option eval-cache false`:
baseline: 10.85 10.86 10.86 10.87 10.87 10.88 10.91 -> median 10.87s
cycle-1: 6.94 6.96 6.98 6.98 7.02 7.02 7.73 -> median 6.98s
Other configurations still evaluate:
- nixosConfigurations.naiveintent
- darwinConfigurations.infinitude-macos
- homeConfigurations."srid@zest"
Removes flake input `nixvim` (+ its `flake-parts`, `nixpkgs`, `systems`
sub-inputs from the lock).
* docs: wrap up Ralph report (10.87s -> 6.99s = -35.7%)
7 dead-ends documented so they don't have to be re-tried. Key
finding: after dropping nixvim (cycle 1), the eval floor is
home-manager's per-entry submodule materialisation
(systemd.user.services / programs.ssh.matchBlocks), not the
option-declaration count of any wrapper module. Inlining
jumphost-nix or vira moves the cost; it does not eliminate it.
- Move AI config from nix-agent-wire/srid to ./AI
- Update flake input: srid/AI -> srid/nix-agent-wire
- Update home modules to use local AI folder via flake.self.outPath
- Add opencode/web.nix module for web service configuration
- Bind to Tailscale IP (100.122.32.106) on port 4096
- Pass JUSPAY_API_KEY from agenix secret to service
- Update flake inputs: nixpkgs/unstable, nix-darwin/master, home-manager/master
