flake.nix

{
  description = "luna-os: an AI-native NixOS, home to the Hermes agent";

  inputs = {
    nixpkgs.url = "github:NixOS/nixpkgs/nixos-unstable";

    # Our kernel source = Penguinjanator/luna-os-kernel (private). Fetched over
    # git+ssh through the `github-penguin` host alias (~/.ssh/config -> the
    # luna-os_ed25519 key). This URL is baked into the OS, so a deployed machine
    # self-updates the same way: drop the key in, `nix flake update`. No access
    # token anywhere. ?ref=main tracks the stable branch.
    luna-kernel = {
      url = "github:Penguinjanator/luna-os-kernel";
      flake = false;
    };

    # Luna's brain: our fork of Nous Research's Hermes Agent. Same git+ssh path
    # so the OS can pull upstream merges itself (`nix flake update hermes`).
    # NB: intentionally NOT following our nixpkgs — she builds against her own
    # locked nixpkgs (uv2nix), matching how upstream tests her.
    #
    # Iterating on UNCOMMITTED local changes? git+ssh fetches the pushed commit,
    # so override per-build instead of editing this file:
    #   nix build .#iso-lab \
    #     --override-input hermes      git+file:///home/potato/work-code/hermes-but-better \
    #     --override-input luna-kernel git+file:///home/potato/work-code/linux-master
    hermes.url = "github:Penguinjanator/hermes-but-better";

    # Luna's native face: Penguinjanator/luna-desktop (the `luna` Rust CLI today;
    # KDE/GNOME surfaces later). Same git+ssh path; a plain source repo with no
    # flake.nix, so flake = false and `${luna-desktop}/cli` is the crate.
    luna-desktop = {
      url = "github:Penguinjanator/luna-desktop";
      flake = false;
    };

    # disko: declarative disk partitioning. Drives the baked-in `luna-install`
    # one-shot installer (disko.nix + modules/disk.nix). Follows our nixpkgs.
    disko = {
      url = "github:nix-community/disko";
      inputs.nixpkgs.follows = "nixpkgs";
    };
  };

  # The real product is `nixosModules` (exported below) — add Luna to ANY NixOS.
  # These concrete nixosConfigurations are our REFERENCE builds + the ISOs: a
  # small matrix on the STOCK kernel,
  #
  #     desktop {terminal, gnome, kde}  x  target {system, iso}
  #
  # desktop = the "flavor" (separate per-desktop images, like upstream NixOS
  #           installers); terminal = no desktop. target = installable/VM
  #           `system`, or a live `iso`. The custom 7.1.0-rc7 kernel is the opt-in
  #           `nixosModules.lab-kernel`, no longer a build axis.
  # Every point shares modules/luna.nix; the grid is generated by `mkSystem`.
  # Names: luna-os, luna-os-iso (terminal); desktops add a -gnome / -kde infix.
  outputs =
    { self, nixpkgs, luna-kernel, hermes, disko, luna-desktop, ... }:
    let
      system = "x86_64-linux";
      lib = nixpkgs.lib;

      isoProfile = "${nixpkgs}/nixos/modules/installer/cd-dvd/installation-cd-minimal.nix";

      # ---- the two axes of the matrix (the kernel is now an opt-in module) ----
      desktops = [ "terminal" "gnome" "kde" ];
      targets = [ "system" "iso" ];

      # Desktop layers; "terminal" adds nothing. (The Nous Electron desktop app
      # was removed: it bootstraps and OWNS its own backend, which fights luna-os's
      # always-on gateway. Luna's interface will be NATIVE KDE/GNOME integration —
      # a Plasma plasmoid/KRunner plugin, a GNOME Shell extension — talking to the
      # gateway, not a wrapped webapp.)
      desktopLayer = {
        terminal = [ ];
        gnome = [ ./modules/desktops/gnome.nix ];
        kde = [ ./modules/desktops/kde.nix ];
      };

      # The custom 7.1.0-rc7 kernel is no longer a build axis — it's the opt-in
      # `nixosModules.lab-kernel` (modules/hermes-kernel.nix). Every config below
      # uses the stock nixpkgs kernel, so nothing here carries a kernel build.

      # Live desktop ISOs autologin the installer's `nixos` user straight into the
      # session — blank-password GUI login is awkward otherwise. (Matches how
      # NixOS's own graphical installer images behave.)
      isoDesktopAutologin = {
        services.displayManager.autoLogin = {
          enable = true;
          user = "luna"; # the one root-capable user (defined in modules/luna.nix)
        };
      };

      # Build one nixosSystem for a {kernel, desktop, target} point in the matrix.
      mkSystem = { desktop, target }:
        lib.nixosSystem {
          inherit system;
          specialArgs = { inherit hermes self luna-desktop; }
            # ISOs are self-contained installers: hand them disko + the name of
            # the system target to install (luna-os-kde-iso installs luna-os-kde).
            // lib.optionalAttrs (target == "iso") {
                 inherit disko;
                 installTarget = sysName { inherit desktop; target = "system"; };
               };
          modules =
            # A "system" is the installable/VM base; an "iso" is the live image.
            # System targets also layer in the disk + bootloader (modules/disk.nix)
            # so they install to a real disk: `nixos-install --flake .#luna-os-kde`.
            (if target == "iso" then [ isoProfile ] else [ ./configuration.nix ./modules/disk.nix ])
            ++ [ hermes.nixosModules.default ./modules/luna.nix ./modules/luna-desktop.nix ]
            ++ desktopLayer.${desktop}
            ++ lib.optional (target == "iso" && desktop != "terminal") isoDesktopAutologin
            # Headless variants re-close the user-namespace surface; desktop
            # variants keep it (Chromium's sandbox needs unprivileged userns).
            ++ lib.optional (desktop == "terminal") ./modules/harden-userns.nix
            # Live ISOs are self-contained installers: bake the flake to
            # /etc/luna-os + ship `disko` and a `luna-install` one-shot.
            ++ lib.optional (target == "iso") ./modules/installer.nix
            # A headless VM of a desktop is pointless — give desktop VM variants a
            # real graphical window (no effect on the ISO or installed system).
            ++ lib.optional (target == "system" && desktop != "terminal") {
              virtualisation.vmVariant.virtualisation.graphics = lib.mkForce true;
            };
        };

      # luna-os[-gnome|-kde][-iso]
      sysName = { desktop, target }:
        "luna-os"
        + lib.optionalString (desktop != "terminal") "-${desktop}"
        + lib.optionalString (target == "iso") "-iso";

      # vm[-gnome|-kde] / iso[-gnome|-kde]
      pkgName = prefix: { desktop }:
        prefix
        + lib.optionalString (desktop != "terminal") "-${desktop}";

      # every {desktop, target} point of the grid
      matrix = lib.concatMap
        (desktop: map (target: { inherit desktop target; }) targets)
        desktops;

      # every {desktop} point (used to name the build targets)
      flavors = map (desktop: { inherit desktop; }) desktops;
    in
    {
      # ── Luna as a LIBRARY ────────────────────────────────────────────────
      # Add these to ANY NixOS config to get Luna — no custom kernel, no bespoke
      # OS. Each module closes over our private inputs (hermes, luna-desktop,
      # luna-kernel), so a consumer just imports it; they need neither the inputs
      # nor specialArgs. A downstream flake does:
      #     imports = [ luna-os.nixosModules.luna luna-os.nixosModules.kde ];
      # and `nix flake update luna-os` pulls our updates while their config (and
      # Luna's own self-edits) stay put.
      nixosModules = {
        # The core Luna stack: the Hermes agent + dashboard services, the base
        # userland, the `luna` CLI, and Luna's identity. Stock kernel — runs
        # anywhere.
        luna = { ... }: {
          imports = [ hermes.nixosModules.default ./modules/luna.nix ./modules/luna-desktop.nix ];
          _module.args = { inherit luna-desktop; };
        };

        # Desktop surface (pick one, alongside `luna`): the Plasma / GNOME
        # session plus Luna's chat widget + launchers.
        kde = { ... }: { imports = [ ./modules/desktops/kde.nix ]; };
        gnome = { ... }: { imports = [ ./modules/desktops/gnome.nix ]; };

        # OPTIONAL: our custom 7.1.0-rc7 kernel — the future home of a
        # /dev/hermes channel + an LSM cage. Import ONLY if you want it; it's the
        # one piece that carries a heavy build. Everything else is stock-kernel.
        lab-kernel = { ... }: {
          imports = [ ./modules/hermes-kernel.nix ];
          _module.args = { inherit luna-kernel; };
        };

        default = self.nixosModules.luna;
      };

      nixosConfigurations = lib.listToAttrs (map
        (pt: { name = sysName pt; value = mkSystem pt; })
        matrix);

      # Build targets — one VM + one ISO per flavor:
      #   nix build .#vm | .#vm-gnome | .#vm-kde | .#vm-lab | .#vm-lab-gnome | .#vm-lab-kde
      #   nix build .#iso | .#iso-gnome | .#iso-kde | .#iso-lab | .#iso-lab-gnome | .#iso-lab-kde
      packages.${system} = lib.listToAttrs (
        (map
          (f: {
            name = pkgName "vm" f;
            value = self.nixosConfigurations.${sysName (f // { target = "system"; })}.config.system.build.vm;
          })
          flavors)
        ++
        (map
          (f: {
            name = pkgName "iso" f;
            value = self.nixosConfigurations.${sysName (f // { target = "iso"; })}.config.system.build.isoImage;
          })
          flavors)
      );
    };
}