Writing

Technical writing on systems, tooling, and the odd rabbit hole worth documenting.

Series

From dotfiles to declarative desktops

A Linux workstation evolved from shell scripts to NixOS, with agentic tooling and defence-in-depth security.

Architecture diagram: declarative workstations and secure AI
  1. The declarative NixOS stack
    How a dotfiles repo evolved from shell scripts into a single flake that reproduces an entire Linux workstation.
  2. The agentic development stack
    How to wire up a multi-model, multi-agent AI environment: OpenCode, Claude Code, MCP servers, 90+ skills, and a three-tier agent pipeline, all managed declaratively.
  3. Security posture: defence-in-depth on a declarative desktop
    Encrypted secrets, encrypted DNS, interactive firewalls, zero-trust networking, and hardware security — all declared in Nix.
  4. Agent security: running untrusted code safely
    AI agents that write and execute code, inside gVisor sandboxes, holding zero secrets, mediated by an audited MCP broker on the host.
  5. Future roadmap: what's next
    Heracles agents, Firecracker microVMs, full NixOS switch, flattened skill architecture, home server convergence, and a ten-year arc.
  6. From NixOS to macOS: Porting a Declarative Workstation Across Platforms
    When a lifetime Linux user buys a MacBook, the dotfiles follow. How the NixOS/Hyprland config from Part 1 survived the platform switch with 90% of home modules intact — and what had to change.
  7. Auditing a Declarative Desktop: What to Look For and What I Found
    After two years of incremental config changes, I audited my own setup for security, hygiene, and correctness. Starting from a threat model, working through each layer — and the surprising things I discovered.
  8. New Machine, One Hour: A Fully Automated macOS Bootstrap
    From a bare MacBook to the full nix-darwin setup in a single script — and the tools that make it possible: OrbStack for Docker/TestContainers, Lima for OpenCode isolation, and the unified setup orchestrator.
  9. The production pass: shared config, security scripts, and the next agent architecture
    After getting macOS working in Parts 6-8, two more sessions to make it right: a single source of truth for work infrastructure, three security utility scripts, and the design for sandboxed multi-agent OpenCode.
  10. Post-publication refinements, corrections, and the migration gap
    Three weeks of daily use after Parts 6-9: what changed, what I got wrong about the Lima VM, the manual migration steps no script can automate, and the honest status of the three-tier agent architecture.
  11. One Repo, Two Machines, Zero Copy-Paste
    Turning a single-person nix-darwin flake into a shared config for two people: how 17 commits of hand-diverged fork drift got collapsed into one file per person, and the audit process that keeps it that way.
  12. The Case of the Generic 'sh'
    Thirteen background agents on my Mac all showed up as a process named 'sh' in Activity Monitor. The root cause was a two-mode home-manager option with no correctly-named option for RunAtLoad agents, and the fix was a 56-line Nix derivation wrapping a compiled Rust binary.
  13. 66 Loose Directories and How I Made Them Nix's Problem
    Six months of git-clone-and-forget agent skills, an audit that found 202 entries and only 4 nix-managed, and the afternoon of merges and tooling that fixed it.
  14. The Lightning Round: Five Small Fixes From the Same Six Weeks
    A full-screen meeting overlay that survives multi-monitor coordinate math, herdr joining tmux in the terminal, an AeroSpace schema bump with a silent behavior change, the docker runtime split, and cutting the local MLX model set from 17 to 5.
Notes