Add portable Home Manager starter

Author: Commanderx-code

modules/home.nix

@@ -0,0 +1,61 @@
+{
+  pkgs,
+  lib,
+  machine,
+  ...
+}:
+{
+  home.username = machine.username;
+  home.homeDirectory = machine.homeDirectory;
+  # Preserve this value for existing installations when updating packages.
+  home.stateVersion = "26.05";
+  programs.home-manager.enable = true;
+  targets.genericLinux.enable = true;
+  xdg.enable = true;
+  home.packages = with pkgs; [
+    ripgrep
+    fd
+    bat
+    eza
+    jq
+  ];
+  programs.fish = lib.mkIf machine.features.fish {
+    enable = true;
+    shellAliases = {
+      ll = "eza -la";
+      gs = "git status";
+    };
+  };
+  programs.starship = {
+    enable = machine.features.fish;
+    enableFishIntegration = machine.features.fish;
+    settings = {
+      add_newline = false;
+      character.success_symbol = "[❯](bold green)";
+    };
+  };
+  programs.fzf = {
+    enable = true;
+    enableFishIntegration = machine.features.fish;
+  };
+  programs.zoxide = {
+    enable = true;
+    enableFishIntegration = machine.features.fish;
+  };
+  programs.neovim = lib.mkIf machine.features.neovim {
+    enable = true;
+    initLua = ''
+      vim.opt.number = true
+      vim.opt.relativenumber = true
+      vim.opt.expandtab = true
+      vim.opt.shiftwidth = 2
+      vim.opt.tabstop = 2
+      vim.opt.ignorecase = true
+      vim.opt.smartcase = true
+      vim.opt.termguicolors = true
+      vim.g.mapleader = " "
+    '';
+  };
+  programs.git.enable = machine.features.development;
+  programs.lazygit.enable = machine.features.development;
+}

scripts/bootstrap.py

@@ -0,0 +1,113 @@
+#!/usr/bin/env python3
+"""Build a private, curated Home Manager source tree; activate only on request."""
+import argparse
+import json
+import os
+from pathlib import Path
+import platform
+import pwd
+import shutil
+import subprocess
+import sys
+import tempfile
+import time
+
+ROOT = Path(__file__).resolve().parents[1]
+FEATURES = ('fish', 'neovim', 'development')
+
+
+def validate(machine):
+    if set(machine) != {'username', 'homeDirectory', 'system', 'features'}:
+        raise ValueError('Machine settings must contain only username, homeDirectory, system, features')
+    if not isinstance(machine['username'], str) or not machine['username'] or '/' in machine['username']:
+        raise ValueError('Invalid username')
+    if not isinstance(machine['homeDirectory'], str) or not machine['homeDirectory'].startswith('/'):
+        raise ValueError('homeDirectory must be an absolute path')
+    if machine['system'] not in ('x86_64-linux', 'aarch64-linux'):
+        raise ValueError('Supported architectures: x86_64-linux and aarch64-linux')
+    if not isinstance(machine['features'], dict) or set(machine['features']) != set(FEATURES):
+        raise ValueError('features must contain fish, neovim, development')
+    if any(type(v) is not bool for v in machine['features'].values()):
+        raise ValueError('Feature values must be true or false')
+    return machine
+
+
+def stage(destination, machine):
+    # Explicit allowlist: never send arbitrary checkout/private files to the Nix store.
+    for name in ('flake.nix', 'flake.lock', 'machine.example.json'):
+        shutil.copyfile(ROOT / name, destination / name)
+    shutil.copytree(ROOT / 'modules', destination / 'modules')
+    (destination / 'machine.json').write_text(json.dumps(validate(machine), indent=2) + '\n')
+
+
+def default_machine():
+    return validate({
+        'username': pwd.getpwuid(os.getuid()).pw_name,
+        'homeDirectory': str(Path.home()),
+        'system': platform.machine() + '-linux',
+        'features': {'fish': True, 'neovim': True, 'development': False},
+    })
+
+
+def main():
+    parser = argparse.ArgumentParser(description=__doc__)
+    parser.add_argument('--apply', action='store_true', help='build, then ask before activating')
+    parser.add_argument('--init', action='store_true', help='create settings only; do not build')
+    parser.add_argument('--config', type=Path, default=Path(os.environ.get('XDG_CONFIG_HOME', str(Path.home() / '.config'))) / 'commander-os/machine.json')
+    args = parser.parse_args()
+    if platform.system() != 'Linux' or os.geteuid() == 0:
+        raise ValueError('Run as your normal user on Linux, without sudo')
+    os.umask(0o077)
+    if args.config.exists():
+        machine = validate(json.loads(args.config.read_text()))
+    else:
+        machine = default_machine()
+        args.config.parent.mkdir(parents=True, exist_ok=True)
+        with args.config.open('x') as target:
+            target.write(json.dumps(machine, indent=2) + '\n')
+        print(f'Created settings: {args.config}', flush=True)
+    print('Features: ' + ', '.join(k for k, v in machine['features'].items() if v), flush=True)
+    if args.init:
+        return 0
+    if not shutil.which('nix'):
+        print('Nix is required; Home Manager does not need to be installed first.\n'
+              'Follow https://nixos.org/download/ for your system.\n'
+              'For Linux with systemd and SELinux disabled, the official multi-user command is:\n'
+              "  curl --proto '=https' --tlsv1.2 -L https://nixos.org/nix/install | sh -s -- --daemon\n"
+              'Then open a new terminal and rerun ./install.sh.', file=sys.stderr)
+        return 1
+    with tempfile.TemporaryDirectory(prefix='commander-os-') as directory:
+        source = Path(directory)
+        stage(source, machine)
+        command = ['nix', '--extra-experimental-features', 'nix-command flakes', 'build',
+                   '--no-write-lock-file', '--no-link', '--print-out-paths',
+                   f'path:{source}#homeConfigurations.commander.activationPackage']
+        print('Building preview; your live configuration will not change during the build.', flush=True)
+        result = subprocess.run(command, check=True, text=True, stdout=subprocess.PIPE)
+        package = Path(result.stdout.strip())
+        if not package.is_absolute() or not (package / 'activate').is_file():
+            raise RuntimeError('Nix did not return a valid activation package')
+        print(f'Built: {package}\nManaged files: {package}/home-files', flush=True)
+        if not args.apply:
+            print('Preview complete. Inspect home-files, edit your settings, then run ./install.sh --apply.')
+            return 0
+        if machine['username'] != pwd.getpwuid(os.getuid()).pw_name or machine['homeDirectory'] != str(Path.home()):
+            raise ValueError('Activation settings must match the current user and home directory')
+        print('This replaces your active Home Manager configuration, if any.\n'
+              'Existing unmanaged conflicts will receive a unique backup suffix.\n'
+              'Review the built home-files and README rollback instructions before continuing.')
+        if input('Type APPLY to activate: ') != 'APPLY':
+            print('Cancelled; no activation performed.')
+            return 0
+        env = dict(os.environ, HOME_MANAGER_BACKUP_EXT=f'commander-os-{time.time_ns()}')
+        subprocess.run([str(package / 'activate')], env=env, check=True)
+        print('Activated. Start fish to try the shell; your login shell was not changed.')
+    return 0
+
+
+if __name__ == '__main__':
+    try:
+        sys.exit(main())
+    except (ValueError, RuntimeError, OSError, subprocess.CalledProcessError, EOFError, KeyboardInterrupt) as error:
+        print(f'Commander-os: {error}', file=sys.stderr)
+        sys.exit(1)

tests/test_bootstrap.py

@@ -0,0 +1,80 @@
+import importlib.util
+import json
+import os
+from pathlib import Path
+import subprocess
+import sys
+import tempfile
+import unittest
+from unittest.mock import patch
+
+spec = importlib.util.spec_from_file_location('bootstrap', Path(__file__).resolve().parents[1] / 'scripts/bootstrap.py')
+bootstrap = importlib.util.module_from_spec(spec)
+spec.loader.exec_module(bootstrap)
+
+
+class BootstrapTests(unittest.TestCase):
+    def setUp(self):
+        self.temp = tempfile.TemporaryDirectory()
+        self.addCleanup(self.temp.cleanup)
+        self.root = Path(self.temp.name)
+        self.machine = json.loads((bootstrap.ROOT / 'machine.example.json').read_text())
+
+    def test_private_files_do_not_enter_build_source(self):
+        source = self.root / 'checkout'
+        source.mkdir()
+        for name in ('flake.nix', 'flake.lock', 'machine.example.json'):
+            (source / name).write_text('{}')
+        (source / 'modules').mkdir()
+        (source / '.env').write_text('fixture-secret')
+        destination = self.root / 'build'
+        destination.mkdir()
+        with patch.object(bootstrap, 'ROOT', source):
+            bootstrap.stage(destination, self.machine)
+        self.assertFalse((destination / '.env').exists())
+        self.assertEqual(json.loads((destination / 'machine.json').read_text()), self.machine)
+
+    def test_rejects_unknown_fields_and_invalid_features(self):
+        self.machine['password'] = 'fixture'
+        with self.assertRaises(ValueError):
+            bootstrap.validate(self.machine)
+        self.machine.pop('password')
+        self.machine['features']['fish'] = 'false'
+        with self.assertRaises(ValueError):
+            bootstrap.validate(self.machine)
+
+    def run_preview(self, apply=False, answer='cancel'):
+        config = self.root / 'machine.json'
+        machine = bootstrap.default_machine()
+        config.write_text(json.dumps(machine))
+        original = config.read_bytes()
+        package = self.root / 'package'
+        package.mkdir()
+        (package / 'activate').touch()
+        argv = ['bootstrap', '--config', str(config)] + (['--apply'] if apply else [])
+        with patch.object(sys, 'argv', argv), patch.object(bootstrap.os, 'geteuid', return_value=1000), \
+             patch.object(bootstrap.shutil, 'which', return_value='/fixture/nix'), \
+             patch.object(bootstrap.subprocess, 'run', return_value=subprocess.CompletedProcess([], 0, str(package))) as run, \
+             patch('builtins.input', return_value=answer) as prompt:
+            self.assertEqual(bootstrap.main(), 0)
+            self.assertEqual(config.read_bytes(), original)
+            return run.call_args_list, prompt.call_count
+
+    def test_preview_never_activates_or_prompts(self):
+        calls, prompts = self.run_preview()
+        self.assertEqual(len(calls), 1)
+        self.assertEqual(prompts, 0)
+
+    def test_cancel_does_not_activate(self):
+        calls, prompts = self.run_preview(apply=True)
+        self.assertEqual(len(calls), 1)
+        self.assertEqual(prompts, 1)
+
+    def test_confirmed_activation_uses_backup_suffix(self):
+        calls, prompts = self.run_preview(apply=True, answer='APPLY')
+        self.assertEqual(len(calls), 2)
+        self.assertTrue(calls[1].kwargs['env']['HOME_MANAGER_BACKUP_EXT'].startswith('commander-os-'))
+
+
+if __name__ == '__main__':
+    unittest.main()