# AGENTS.md

## Repo purpose

This repository contains flake-based NixOS configurations for Wayne's LAN
servers and workstation.

The flake exposes NixOS configurations named `<platform>-<buildtype>`
(platforms: `linode`, `proxmox`, `lxc`; build types: `minimal`, `nix-cache`,
`server`, `docker`, `gui`, `pxe-boot`, `tailscale-exit-node`, `tor-relay`), generated from `modules/platforms/*`
and `modules/build-types/*` by the `mkTarget` function in `flake.nix`. Not
every combination is built — `pxe-boot` has no `linode` variant. See
`README.md` for the full current target list; treat `flake.nix` as the
source of truth since this list can drift.

Do not deploy, switch, reboot, repartition, format disks, or run destructive
install commands from this repository unless explicitly asked.

## Safety rules

- Never run `nixos-rebuild switch`, `boot`, `test`, `nixos-install`, `parted`,
  `mkfs`, `mkswap`, `swapon`, `mount`, or destructive disk commands in Codex.
- Validation work should be limited to evaluation, linting, formatting checks,
  and `nix build --dry-run --no-link`.
- Do not add secrets, tokens, private keys, password hashes, or live credentials
  to the repo.
- Treat `flake.nix`, Home Manager config, and Nix config files as public.
- If you find committed tokens or hashes, flag them immediately and recommend
  rotation/removal.

## Expected commands

Use these commands when validating changes:

```bash
bash scripts/codex-setup.sh
bash scripts/codex-maintenance.sh
```

With no flags, `codex-maintenance.sh` scopes fmt-check/statix/eval to files
changed against a base ref — this is what CI runs on every push/PR. For the
full sweep (every host, every package — slow; CI never runs this), use
`bash scripts/codex-maintenance.sh --full-check` (add `--dry-run` for build
planning on top of whichever scope is active).

Host evaluation is safe when limited to drvPath checks:

```bash
nix eval .#nixosConfigurations.<host>.config.system.build.toplevel.drvPath --raw
```