Writing

Series

From dotfiles to declarative desktops

How a Linux workstation evolved from shell scripts to a fully declarative NixOS setup, with agentic AI tooling and defence-in-depth security.

• Part 1

  The declarative NixOS stack

  How a dotfiles repo evolved from shell scripts into a single flake that reproduces an entire Linux workstation.

  →
• Part 2

  The agentic development stack

  How to wire up a multi-model, multi-agent AI environment: OpenCode, Claude Code, MCP servers, 90+ skills, and a three-tier agent pipeline, all managed declaratively.

  →
• Part 3

  Security posture: defence-in-depth on a declarative desktop

  Encrypted secrets, encrypted DNS, interactive firewalls, zero-trust networking, and hardware security — all declared in Nix.

  →
• Part 4

  Agent security: running untrusted code safely

  AI agents that write and execute code, inside gVisor sandboxes, holding zero secrets, mediated by an audited MCP broker on the host.

  →
• Part 5

  Future roadmap: what's next

  Heracles agents, Firecracker microVMs, full NixOS switch, flattened skill architecture, home server convergence, and a ten-year arc.

  →
• Part

  Writing

  →