From 3d15148c770bb11465305a87aa24814992e1c167 Mon Sep 17 00:00:00 2001
From: poslop <poslop@archfox.org>
Date: Fri, 28 Aug 2026 14:13:43 +0000
Subject: [PATCH 1/3] roles: add role-based host composition in flake

- mkHost now takes a role list, roles resolve to ./roles/<name>.nix
- roles/core.nix = shared baseline (modules/)
- roles/k3s-server.nix = core + k3s (goyplex-vm)
- roles/hermes.nix = core + hermes (hermes-vm)
- host configuration.nix trimmed to hardware + boot + stateVersion
- optional hosts/<name>/custom.nix loads last for per-host overrides
- new hosts: one flake line + hosts/<name>/ dir
---
 flake.nix                          | 28 +++++++++++++++++++++-------
 hosts/goyplex-vm/configuration.nix |  7 ++++---
 hosts/hermes-vm/configuration.nix  |  7 ++++---
 hosts/nixos-vm2/configuration.nix  |  1 -
 hosts/qemu-vm/configuration.nix    |  1 -
 roles/core.nix                     |  6 ++++++
 roles/hermes.nix                   |  7 +++++++
 roles/k3s-server.nix               |  7 +++++++
 8 files changed, 49 insertions(+), 15 deletions(-)
 create mode 100644 roles/core.nix
 create mode 100644 roles/hermes.nix
 create mode 100644 roles/k3s-server.nix

diff --git a/flake.nix b/flake.nix
index 65dd8a0..3109786 100644
--- a/flake.nix
+++ b/flake.nix
@@ -27,26 +27,40 @@
     let
       system = "x86_64-linux";
       username = "poslop";
+      lib = nixpkgs.lib;
+
+      # mkHost <hostname> <role list>
+      # roles resolve to ./roles/<name>.nix; list entries may also be
+      # inline attrsets or paths, which load after (and override) roles.
+      # hosts/<host>/custom.nix, if present, always loads last.
       mkHost =
-        host: modules:
+        name: roles:
         nixpkgs.lib.nixosSystem {
-          modules = [ { nixpkgs.hostPlatform = system; } ] ++ modules;
+          modules =
+            [ { nixpkgs.hostPlatform = system; } ]
+            ++ [ ./hosts/${name}/configuration.nix ]
+            ++ map (
+              role:
+              if builtins.isString role then ./roles/${role}.nix else role
+            ) roles
+            ++ lib.optional (builtins.pathExists ./hosts/${name}/custom.nix)
+              ./hosts/${name}/custom.nix;
           specialArgs = {
             inherit
               self
               inputs
               username
-              host
               ;
+            host = name;
           };
         };
     in
     {
       nixosConfigurations = {
-        nixos-vm2 = mkHost "nixos-vm2" [ ./hosts/nixos-vm2/configuration.nix ];
-        qemu-vm = mkHost "qemu-vm" [ ./hosts/qemu-vm/configuration.nix ];
-        goyplex-vm = mkHost "goyplex-vm" [ ./hosts/goyplex-vm/configuration.nix ];
-        hermes-vm = mkHost "hermes-vm" [ ./hosts/hermes-vm/configuration.nix ];
+        nixos-vm2 = mkHost "nixos-vm2" [ "core" ];
+        qemu-vm = mkHost "qemu-vm" [ "core" ];
+        goyplex-vm = mkHost "goyplex-vm" [ "k3s-server" ];
+        hermes-vm = mkHost "hermes-vm" [ "hermes" ];
       };
     };
 }
diff --git a/hosts/goyplex-vm/configuration.nix b/hosts/goyplex-vm/configuration.nix
index ec77758..1f679a6 100644
--- a/hosts/goyplex-vm/configuration.nix
+++ b/hosts/goyplex-vm/configuration.nix
@@ -1,10 +1,11 @@
-{ pkgs, ... }:
+{
+  pkgs,
+  ...
+}:
 
 {
   imports = [
     ./hardware-configuration.nix
-    ../../modules
-    ../../modules/k3s/k3s.nix
   ];
 
   boot.loader.systemd-boot.enable = true;
diff --git a/hosts/hermes-vm/configuration.nix b/hosts/hermes-vm/configuration.nix
index a3d6a2d..1f679a6 100644
--- a/hosts/hermes-vm/configuration.nix
+++ b/hosts/hermes-vm/configuration.nix
@@ -1,10 +1,11 @@
-{ pkgs, ... }:
+{
+  pkgs,
+  ...
+}:
 
 {
   imports = [
     ./hardware-configuration.nix
-    ../../modules/core
-    ../../modules/hermes
   ];
 
   boot.loader.systemd-boot.enable = true;
diff --git a/hosts/nixos-vm2/configuration.nix b/hosts/nixos-vm2/configuration.nix
index fd54cb1..9b1c8dd 100644
--- a/hosts/nixos-vm2/configuration.nix
+++ b/hosts/nixos-vm2/configuration.nix
@@ -5,7 +5,6 @@
 {
   imports = [
     ./hardware-configuration.nix
-    ../../modules
   ];
 
   boot.loader.grub.enable = true;
diff --git a/hosts/qemu-vm/configuration.nix b/hosts/qemu-vm/configuration.nix
index 866fe4e..62ebaa4 100644
--- a/hosts/qemu-vm/configuration.nix
+++ b/hosts/qemu-vm/configuration.nix
@@ -5,7 +5,6 @@
 {
   imports = [
     ./hardware-configuration.nix
-    ../../modules
   ];
 
   boot.loader.grub.enable = true;
diff --git a/roles/core.nix b/roles/core.nix
new file mode 100644
index 0000000..5db7cb9
--- /dev/null
+++ b/roles/core.nix
@@ -0,0 +1,6 @@
+{
+  # shared baseline: core system + home manager config
+  imports = [
+    ../modules
+  ];
+}
diff --git a/roles/hermes.nix b/roles/hermes.nix
new file mode 100644
index 0000000..ebe73a8
--- /dev/null
+++ b/roles/hermes.nix
@@ -0,0 +1,7 @@
+{
+  # hermes agent host: core + hermes container + secrets
+  imports = [
+    ./core.nix
+    ../modules/hermes
+  ];
+}
diff --git a/roles/k3s-server.nix b/roles/k3s-server.nix
new file mode 100644
index 0000000..e7331bb
--- /dev/null
+++ b/roles/k3s-server.nix
@@ -0,0 +1,7 @@
+{
+  # k3s server node (goyplex-vm): k3s + manifests + firewall
+  imports = [
+    ./core.nix
+    ../modules/k3s/k3s.nix
+  ];
+}

From 5e0bcc53ff0253f497c7b66e173ddf64e812f6c5 Mon Sep 17 00:00:00 2001
From: poslop <poslop@archfox.org>
Date: Fri, 28 Aug 2026 09:21:45 -0500
Subject: [PATCH 2/3] write test

---
 .write-test | 1 +
 1 file changed, 1 insertion(+)
 create mode 100644 .write-test

diff --git a/.write-test b/.write-test
new file mode 100644
index 0000000..30d74d2
--- /dev/null
+++ b/.write-test
@@ -0,0 +1 @@
+test
\ No newline at end of file

From 041a8a36af86e57559f3e0a0abc5f55b7369a5fd Mon Sep 17 00:00:00 2001
From: poslop <poslop@archfox.org>
Date: Fri, 28 Aug 2026 14:22:26 +0000
Subject: [PATCH 3/3] remove write test file

---
 .write-test | 1 -
 1 file changed, 1 deletion(-)
 delete mode 100644 .write-test

diff --git a/.write-test b/.write-test
deleted file mode 100644
index 30d74d2..0000000
--- a/.write-test
+++ /dev/null
@@ -1 +0,0 @@
-test
\ No newline at end of file