split off terminal utilities

flake.nix

@@ -163,6 +163,9 @@
 
       niriPackage = inputs.niri.packages.${system}.niri-unstable;
 
+      # --- Desktop-channel pkgs (used by portable homeConfigurations) ---
+      desktopPkgs = import nixpkgs { inherit system; };
+
       # --- Server (muffin) plumbing ---
       bootstrapPkgs = import nixpkgs-stable { inherit system; };
       patchedStableSrc = bootstrapPkgs.applyPatches {
@@ -367,6 +370,24 @@
         muffin = muffinHost;
       };
 
+      # Standalone home-manager profile — usable on any x86_64-linux machine
+      # with nix installed (NixOS or not). Activate with:
+      #   nix run home-manager/master -- switch --flake ".#primary"
+      # Ships the shared terminal profile (fish, helix, modern CLI, git).
+      homeConfigurations.primary = home-manager.lib.homeManagerConfiguration {
+        pkgs = desktopPkgs;
+        modules = [
+          ./home/profiles/terminal.nix
+          {
+            home = {
+              username = username;
+              homeDirectory = "/home/${username}";
+              stateVersion = "24.11";
+            };
+          }
+        ];
+      };
+
       deploy.nodes.muffin = {
         hostname = "server-public";
         profiles.system = {
@@ -395,6 +416,11 @@
             path = test;
           }) testSuite
         );
+
+        # Buildenv of every binary in the portable terminal profile. Install
+        # without home-manager via:
+        #   nix profile install ".#cli-tools"
+        cli-tools = self.homeConfigurations.primary.config.home.path;
       }
       // (serverPkgs.lib.mapAttrs' (name: test: {
         name = "test-${name}";

home/profiles/gui.nix

@@ -227,4 +227,11 @@
       uris = [ "qemu:///system" ];
     };
   };
+
+  # macOS-style clipboard aliases — depend on wl-clipboard, so scoped here
+  # rather than in the shared fish config.
+  programs.fish.shellAliases = {
+    pbcopy = "${pkgs.wl-clipboard}/bin/wl-copy";
+    pbpaste = "${pkgs.wl-clipboard}/bin/wl-paste";
+  };
 }

home/profiles/no-gui.nix

@@ -59,83 +59,16 @@ let
     # jasmin
   ];
 
-  common_tools = with pkgs; [
+  # hardware diagnostics — wanted on dev machines, not part of the shared
-    # hex viewer
+  # terminal profile (which is meant to be portable to any machine).
-    hexyl
+  hw_diag = with pkgs; [
-
-    # find typos in code
-    typos
-
-    # replacements for common posix tools
-    eza # ls replacement
-    bat # pretty `cat` clone
-    delta # viewer for `git` and `diff` output
-    dust # pretty `du` version
-    duf # better `df` clone
-    gping # `ping`... but with a graph!!
-    tldr # `man` but more straight-forward and simpler
-    ripgrep # grep, but written in rust, respects .gitignore, and very very fast, command is `rg`
-    fd # alternative to `find`
-
-    # status tools
-    htop
-    bottom
-
-    # other tools
-    unzip
-    wget
-    killall
-    file
-    b3sum
-
-    # "A hexadecimal, binary, and ASCII dump utility with color support"
-    tinyxxd
-
-    # networking tool
-    lsof
-
-    # view SMART status of drives
     smartmontools
-
-    # adds `sensors` command
     lm_sensors
-
-    # lspci
     pciutils
-
-    # convert between various units
-    units
-
-    jq
-
-    # DNS things
-    dig
-
-    bun
   ];
 
-in
+  # dev-only tools. Universal CLI (bat, rg, htop, jq, …) lives in terminal.nix.
-{
+  dev_tools = with pkgs; [
-  imports = [
-    ../progs/fish.nix
-    ../progs/helix.nix
-    ../progs/pi.nix
-    (
-      { ... }:
-      {
-        nixpkgs.overlays = [
-          inputs.rust-overlay.overlays.default
-        ];
-      }
-    )
-  ];
-
-  home.stateVersion = stateVersion;
-
-  home.packages =
-    with pkgs;
-    lib.concatLists [
-      [
     # python formatter
     ruff
 
@@ -143,23 +76,13 @@ in
     hugo
     go
 
-        # for benchmaking stuff
-        hyperfine
-
-        pfetch-rs
     waypipe
 
     sshfs
 
-        # nix formatter
-        nixfmt-tree
-
     # serial viewer
     minicom
 
-        # "~~matt's~~ my trace route"
-        mtr
-
     ffmpeg-full
 
     # microcontroller tooling
@@ -189,10 +112,6 @@ in
     clang
     gdb
 
-        git-crypt
-
-        imagemagick
-
     nixpkgs-review
 
     nmap
@@ -212,51 +131,52 @@ in
     powerstat
 
     yt-dlp
-      ]
+
+    # JS runtime
+    bun
+
+    # convert between various units
+    units
+  ];
+in
+{
+  imports = [
+    ./terminal.nix
+    ../progs/pi.nix
+    (
+      { ... }:
+      {
+        nixpkgs.overlays = [
+          inputs.rust-overlay.overlays.default
+        ];
+      }
+    )
+  ];
+
+  home.stateVersion = stateVersion;
+
+  home.packages = lib.concatLists [
     rust_pkgs
     lsps
     java_tools
-      common_tools
+    hw_diag
+    dev_tools
   ];
 
+  # fish aliases that depend on packages only present in this profile.
+  # Universal aliases (ls/la/ll/lt, git-size) live in home/progs/fish.nix.
+  programs.fish.shellAliases = {
+    c = "${lib.getExe pkgs.cargo}";
+    cr = "${lib.getExe pkgs.cargo} run";
+    cb = "${lib.getExe pkgs.cargo} build";
+
+    gcc-native = "${lib.getExe pkgs.gcc} -Q --help=target -mtune=native -march=native | ${lib.getExe pkgs.gnugrep} -E '^\\s+\\-(mtune|march)=' | ${pkgs.coreutils}/bin/tr -d '[:blank:]'";
+  };
+
   # https://github.com/flamegraph-rs/flamegraph
   home.file.".cargo/config.toml".text = ''
     [target.${lib.strings.removeSuffix "-linux" pkgs.stdenv.hostPlatform.system}-unknown-linux-gnu]
     linker = "${lib.getExe pkgs.clang}"
     rustflags = ["-Clink-arg=-Wl,--no-rosegment"]
   '';
-
-  # git (self explanatory)
-  programs.git = {
-    enable = true;
-    package = pkgs.git;
-
-    lfs.enable = true;
-
-    ignores = [ ".sisyphus" ];
-
-    settings = {
-      init = {
-        # master -> main
-        defaultBranch = "main";
-      };
-      push.autoSetupRemote = true;
-      user = {
-        name = "Simon Gardling";
-        email = "titaniumtown@proton.me";
-      };
-    };
-
-    # gpg signing keys
-    signing = {
-      key = "9AB28AC10ECE533D";
-      signByDefault = true;
-    };
-  };
-
-  # better way to view diffs
-  programs.delta = {
-    enable = true;
-    enableGitIntegration = true;
-  };
 }

home/profiles/terminal.nix

@@ -0,0 +1,102 @@
+# Shared terminal-tools profile.
+#
+# The set of CLI tooling I want available on every machine I use:
+# - mreow + yarn pick this up via home/profiles/no-gui.nix
+# - muffin picks this up via hosts/muffin/home.nix
+# - any non-NixOS machine picks it up via the homeConfigurations output in flake.nix
+#
+# Scope is intentionally narrow: the daily-driver shell (fish + helix + modern
+# CLI replacements + git). No language toolchains, no hardware-specific admin
+# tools, no GUI-adjacent utilities — those belong in profiles layered on top.
+{
+  lib,
+  pkgs,
+  ...
+}:
+{
+  imports = [
+    ../progs/fish.nix
+    ../progs/helix.nix
+  ];
+
+  home.packages = with pkgs; [
+    # modern CLI replacements for POSIX basics
+    eza # ls
+    bat # cat
+    delta # diff viewer (also wired into git below)
+    dust # du
+    duf # df
+    gping # ping, with a graph
+    ripgrep # grep, respects .gitignore
+    fd # find
+    tldr # man, simpler
+
+    # system / process tools
+    htop
+    bottom
+    lsof
+    file
+    killall
+    unzip
+    tmux
+    wget
+
+    # network
+    dig
+    mtr
+
+    # text / data
+    jq
+    hexyl
+    tinyxxd
+    b3sum
+    typos
+
+    # media (handy from a shell, lightweight enough to be universal)
+    imagemagick
+
+    # universal dev-adjacent
+    git-crypt
+    hyperfine
+
+    # nix
+    nixfmt-tree
+
+    # shell greeter (invoked from fish's interactiveShellInit)
+    pfetch-rs
+  ];
+
+  # Git: mechanical config + identity lives here so `git` works out of the box
+  # on every machine. Signing is opt-in via lib.mkDefault so machines without
+  # my GPG key can override `signing.signByDefault = false` without fighting
+  # priority.
+  programs.git = {
+    enable = true;
+    package = pkgs.git;
+
+    lfs.enable = true;
+
+    ignores = [ ".sisyphus" ];
+
+    settings = {
+      init.defaultBranch = "main";
+      push.autoSetupRemote = true;
+      user = {
+        name = "Simon Gardling";
+        email = "titaniumtown@proton.me";
+      };
+    };
+
+    signing = {
+      format = "openpgp";
+      key = lib.mkDefault "9AB28AC10ECE533D";
+      signByDefault = lib.mkDefault true;
+    };
+  };
+
+  # Pretty diff viewer, wired into git.
+  programs.delta = {
+    enable = true;
+    enableGitIntegration = true;
+  };
+}

home/progs/fish.nix

@@ -1,7 +1,12 @@
+# Shared fish configuration — imported from home/profiles/terminal.nix, so it
+# runs on every host (mreow, yarn, muffin, and any machine using the portable
+# homeConfigurations output).
+#
+# Desktop/dev-specific aliases (cargo, gcc, wl-clipboard) are added from the
+# profile that owns their dependencies, not here.
 { pkgs, lib, ... }:
 let
   eza = "${lib.getExe pkgs.eza} --color=always --group-directories-first";
-  cargo = "${lib.getExe pkgs.cargo}";
   coreutils = "${pkgs.coreutils}/bin";
 in
 {
@@ -20,10 +25,6 @@ in
     '';
 
     shellAliases = {
-      c = cargo;
-      cr = "${cargo} run";
-      cb = "${cargo} build";
-
       # from DistroTube's dot files: Changing "ls" to "eza"
       ls = "${eza} -al";
       la = "${eza} -a";
@@ -38,12 +39,6 @@ in
                 ${coreutils}/sort --numeric-sort --key=2 |
                 ${coreutils}/cut -c 1-12,41- |
                 ${coreutils}/numfmt --field=2 --to=iec-i --suffix=B --padding=7 --round=nearest'';
-
-      # aliases for (I think) macos commands
-      pbcopy = "${pkgs.wl-clipboard}/bin/wl-copy";
-      pbpaste = "${pkgs.wl-clipboard}/bin/wl-paste";
-
-      gcc-native = "${lib.getExe pkgs.gcc} -Q --help=target -mtune=native -march=native | ${lib.getExe pkgs.gnugrep} -E '^\\s+\-(mtune|march)=' | ${coreutils}/tr -d '[:blank:]'";
     };
 
     shellInit = ''

hosts/muffin/default.nix

@@ -161,35 +161,21 @@
     ];
   };
 
+  # Root-facing admin tools only. User-facing CLI (fish, helix, htop, bottom,
+  # tmux, ripgrep, lsof, wget, pfetch-rs, …) is provided via home-manager in
+  # home/profiles/terminal.nix — shared with mreow and yarn.
   environment.systemPackages = with pkgs; [
-    helix
     lm_sensors
-    bottom
-    htop
-
-    neofetch
-
     borgbackup
     smartmontools
 
-    ripgrep
-
     intel-gpu-tools
     iotop
     iftop
-
-    tmux
-
-    wget
-
     powertop
 
-    lsof
-
     reflac
 
-    pfetch-rs
-
     sbctl
 
     # add `skdump`

hosts/muffin/home.nix

@@ -1,31 +1,12 @@
+{ ... }:
 {
-  pkgs,
+  imports = [
-  lib,
+    ../../home/profiles/terminal.nix
-  ...
+  ];
-}:
+
-{
   home.stateVersion = "24.11";
-  programs.fish = {
-    enable = true;
 
-    interactiveShellInit = ''
+  # Muffin typically doesn't have the GPG key loaded (no agent forwarded,
-      # disable greeting
+  # no key in the keyring). Unsigned commits here rather than failing silently.
-      set fish_greeting
+  programs.git.signing.signByDefault = false;
-
-      # pfetch on shell start (disable pkgs because of execution time)
-      PF_INFO="ascii title os host kernel uptime memory editor wm" ${lib.getExe pkgs.pfetch-rs}
-    '';
-
-    shellAliases =
-      let
-        eza = "${lib.getExe pkgs.eza} --color=always --group-directories-first";
-      in
-      {
-        # from DistroTube's dot files: Changing "ls" to "eza"
-        ls = "${eza} -al";
-        la = "${eza} -a";
-        ll = "${eza} -l";
-        lt = "${eza} -aT";
-      };
-  };
 }