# AGENTS.md

## Repo purpose

This repository contains flake-based NixOS configurations for Wayne's LAN
servers and workstation.

The flake exposes NixOS configurations named `<platform>-<buildtype>`
(platforms: `linode`, `proxmox`, `lxc`; build types: `minimal`, `nix-cache`,
`server`, `docker`, `gui`, `pxe-boot`, `tailscale-exit-node`), generated from `modules/platforms/*`
and `modules/build-types/*` by the `mkTarget` function in `flake.nix`. Not
every combination is built — `pxe-boot` has no `linode` variant. See
`README.md` for the full current target list; treat `flake.nix` as the
source of truth since this list can drift.

Do not deploy, switch, reboot, repartition, format disks, or run destructive
install commands from this repository unless explicitly asked.

## Safety rules

- Never run `nixos-rebuild switch`, `boot`, `test`, `nixos-install`, `parted`,
  `mkfs`, `mkswap`, `swapon`, `mount`, or destructive disk commands in Codex.
- Validation work should be limited to evaluation, linting, formatting checks,
  and `nix build --dry-run --no-link`.
- Do not add secrets, tokens, private keys, password hashes, or live credentials
  to the repo.
- Treat `flake.nix`, Home Manager config, and Nix config files as public.
- If you find committed tokens or hashes, flag them immediately and recommend
  rotation/removal.

## Expected commands

Use these commands when validating changes:

```bash
bash scripts/codex-setup.sh
bash scripts/codex-maintenance.sh
bash scripts/codex-maintenance.sh dry-run
```

Host evaluation is safe when limited to drvPath checks:

```bash
nix eval .#nixosConfigurations.<host>.config.system.build.toplevel.drvPath --raw
```