wip

flake.lock

@@ -84,6 +84,24 @@
         "type": "github"
       }
     },
+    "claude-code-overlay": {
+      "inputs": {
+        "nixpkgs": "nixpkgs"
+      },
+      "locked": {
+        "lastModified": 1772160751,
+        "narHash": "sha256-PXv9nrm8HHLGIU2B1XRjOvzlPW9sFdzbtWiJQ1wE8dM=",
+        "owner": "ryoppippi",
+        "repo": "claude-code-overlay",
+        "rev": "662bdbf5ea61fc3cde167bbe3686343a149ea6c6",
+        "type": "github"
+      },
+      "original": {
+        "owner": "ryoppippi",
+        "repo": "claude-code-overlay",
+        "type": "github"
+      }
+    },
     "crane": {
       "locked": {
         "lastModified": 1765145449,
@@ -297,7 +315,7 @@
       "inputs": {
         "flake-parts": "flake-parts",
         "neovim-src": "neovim-src",
-        "nixpkgs": "nixpkgs"
+        "nixpkgs": "nixpkgs_2"
       },
       "locked": {
         "lastModified": 1771891493,
@@ -331,16 +349,16 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1771423170,
+        "lastModified": 1768127708,
-        "narHash": "sha256-K7Dg9TQ0mOcAtWTO/FX/FaprtWQ8BmEXTpLIaNRhEwU=",
+        "narHash": "sha256-1Sm77VfZh3mU0F5OqKABNLWxOuDeHIlcFjsXeeiPazs=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "bcc4a9d9533c033d806a46b37dc444f9b0da49dd",
+        "rev": "ffbc9f8cbaacfb331b6017d5a5abb21a492c9a38",
         "type": "github"
       },
       "original": {
         "owner": "NixOS",
-        "ref": "nixpkgs-unstable",
+        "ref": "nixos-unstable",
         "repo": "nixpkgs",
         "type": "github"
       }
@@ -378,6 +396,22 @@
       }
     },
     "nixpkgs_2": {
+      "locked": {
+        "lastModified": 1771423170,
+        "narHash": "sha256-K7Dg9TQ0mOcAtWTO/FX/FaprtWQ8BmEXTpLIaNRhEwU=",
+        "owner": "NixOS",
+        "repo": "nixpkgs",
+        "rev": "bcc4a9d9533c033d806a46b37dc444f9b0da49dd",
+        "type": "github"
+      },
+      "original": {
+        "owner": "NixOS",
+        "ref": "nixpkgs-unstable",
+        "repo": "nixpkgs",
+        "type": "github"
+      }
+    },
+    "nixpkgs_3": {
       "locked": {
         "lastModified": 1771714954,
         "narHash": "sha256-nhZJPnBavtu40/L2aqpljrfUNb2rxmWTmSjK2c9UKds=",
@@ -444,11 +478,12 @@
     "root": {
       "inputs": {
         "assets": "assets",
+        "claude-code-overlay": "claude-code-overlay",
         "flake-utils": "flake-utils",
         "home-manager": "home-manager",
         "lanzaboote": "lanzaboote",
         "neovim-nightly-overlay": "neovim-nightly-overlay",
-        "nixpkgs": "nixpkgs_2",
+        "nixpkgs": "nixpkgs_3",
         "nixpkgs-master": "nixpkgs-master",
         "nixpkgs-unstable": "nixpkgs-unstable",
         "stylix": "stylix"

flake.nix

@@ -27,10 +27,6 @@
       inputs.nixpkgs.follows = "nixpkgs";
     };
 
-    neovim-nightly-overlay = {
-      url = "github:nix-community/neovim-nightly-overlay";
-    };
-
     lanzaboote = {
       url = "github:nix-community/lanzaboote/v1.0.0";
       inputs.nixpkgs.follows = "nixpkgs";
@@ -40,6 +36,9 @@
       url = "git+https://git.janezic.dev/janezicmatej/assets.git";
       flake = false;
     };
+
+    neovim-nightly-overlay.url = "github:nix-community/neovim-nightly-overlay";
+    claude-code-overlay.url = "github:ryoppippi/claude-code-overlay";
   };
 
   outputs =
@@ -94,6 +93,12 @@
           system = "x86_64-linux";
           users = [ ];
         };
+
+        # nixos-rebuild build-image --image-variant qemu --flake .#sandbox
+        sandbox = mkHost "sandbox" {
+          system = "x86_64-linux";
+          users = [ "gorazd" ];
+        };
       };
 
       nixosModules = import ./modules/nixos {

hosts/sandbox/configuration.nix

@@ -0,0 +1,132 @@
+{
+  pkgs,
+  lib,
+  inputs,
+  ...
+}:
+{
+  imports = [
+    ./hardware-configuration.nix
+    inputs.self.nixosModules.vm-guest
+    inputs.self.nixosModules.desktop
+    inputs.self.nixosModules.zsh
+  ];
+
+  vm-guest.enable = true;
+  desktop.enable = true;
+  zsh.enable = true;
+
+  programs.labwc.enable = true;
+
+  # labwc stacking compositor with auto-login
+  services.greetd =
+    let
+      labwc-session = pkgs.writeShellScript "labwc-session" ''
+        export XDG_SESSION_TYPE=wayland
+        export XDG_CURRENT_DESKTOP=labwc:wlroots
+        # software renderer for qemu virtio-vga
+        export WLR_RENDERER=pixman
+        export WLR_DRM_NO_ATOMIC=1
+        exec ${pkgs.labwc}/bin/labwc
+      '';
+    in
+    {
+      enable = true;
+      settings = {
+        default_session = {
+          command = labwc-session;
+          user = "gorazd";
+        };
+        initial_session = {
+          command = labwc-session;
+          user = "gorazd";
+        };
+      };
+    };
+
+  users = {
+    groups.gorazd = {
+      gid = 1000;
+    };
+    users.gorazd = {
+      group = "gorazd";
+      uid = 1000;
+      isNormalUser = true;
+      home = "/home/gorazd";
+      createHome = true;
+      password = "sandbox";
+      extraGroups = [
+        "wheel"
+        "users"
+      ];
+    };
+  };
+
+  # 9p mounts for host files
+  fileSystems."/home/gorazd/projects" = {
+    device = "projects";
+    fsType = "9p";
+    options = [
+      "trans=virtio"
+      "version=9p2000.L"
+      "msize=65536"
+      "nofail"
+    ];
+  };
+
+  fileSystems."/mnt/host-claude" = {
+    device = "hostclaude";
+    fsType = "9p";
+    options = [
+      "trans=virtio"
+      "version=9p2000.L"
+      "msize=65536"
+      "nofail"
+    ];
+  };
+
+  fileSystems."/mnt/host-home" = {
+    device = "hosthome";
+    fsType = "9p";
+    options = [
+      "trans=virtio"
+      "version=9p2000.L"
+      "msize=65536"
+      "nofail"
+      "ro"
+    ];
+  };
+
+  # pre-auth claude-code from host config
+  systemd.services.claude-auth = {
+    description = "Copy claude-code credentials from host mount";
+    after = [
+      "mnt-host\\x2dclaude.mount"
+      "mnt-host\\x2dhome.mount"
+    ];
+    requires = [
+      "mnt-host\\x2dclaude.mount"
+      "mnt-host\\x2dhome.mount"
+    ];
+    wantedBy = [ "multi-user.target" ];
+    serviceConfig = {
+      Type = "oneshot";
+      ExecStart = pkgs.writeShellScript "claude-auth" ''
+        mkdir -p /home/gorazd/.claude
+        cp -a /mnt/host-claude/. /home/gorazd/.claude/
+        cp /mnt/host-home/.claude.json /home/gorazd/.claude.json || true
+        chown -R gorazd:gorazd /home/gorazd/.claude /home/gorazd/.claude.json
+      '';
+    };
+  };
+
+  environment.systemPackages = with pkgs; [
+    claude-code
+    labwc
+    sfwbar
+    foot
+    firefox
+  ];
+
+  system.stateVersion = "25.11";
+}

hosts/sandbox/hardware-configuration.nix

@@ -0,0 +1,18 @@
+{
+  lib,
+  modulesPath,
+  ...
+}:
+{
+  imports = [
+    (modulesPath + "/profiles/qemu-guest.nix")
+  ];
+
+  fileSystems."/" = {
+    device = "/dev/disk/by-label/nixos";
+    autoResize = true;
+    fsType = "ext4";
+  };
+
+  boot.loader.grub.device = lib.mkDefault "/dev/vda";
+}

justfile

@@ -24,3 +24,37 @@ iso:
 # garbage collect old generations
 clean:
     sudo nix-collect-garbage $(nix eval --raw -f ./nix.nix nix.gc.options)
+
+# build sandbox VM image
+sandbox-build:
+    nixos-rebuild build-image --image-variant qemu --flake .#sandbox
+
+# run sandbox with GUI (ephemeral, changes discarded)
+sandbox-run:
+    nix shell nixpkgs#qemu -c qemu-system-x86_64 -enable-kvm -m 8G -smp 4 \
+      -drive file=$(find -L result -name '*.qcow2' | head -1),format=qcow2,snapshot=on \
+      -vga virtio -display gtk,zoom-to-fit=false \
+      -device virtio-serial-pci \
+      -chardev qemu-vdagent,id=ch1,name=vdagent,clipboard=on \
+      -device virtserialport,chardev=ch1,id=ch1,name=com.redhat.spice.0 \
+      -virtfs local,path=$HOME/git,mount_tag=projects,security_model=mapped-xattr,id=fs0 \
+      -virtfs local,path=$HOME/.claude,mount_tag=hostclaude,security_model=mapped-xattr,id=fs1 \
+      -virtfs local,path=$HOME,mount_tag=hosthome,security_model=mapped-xattr,id=fs2,readonly=on \
+      -nic user,hostfwd=tcp::2222-:22
+
+# run sandbox headless (ephemeral, changes discarded)
+sandbox-run-headless:
+    nix shell nixpkgs#qemu -c qemu-system-x86_64 -enable-kvm -m 8G -smp 4 \
+      -drive file=$(find -L result -name '*.qcow2' | head -1),format=qcow2,snapshot=on \
+      -virtfs local,path=$HOME/git,mount_tag=projects,security_model=mapped-xattr,id=fs0 \
+      -virtfs local,path=$HOME/.claude,mount_tag=hostclaude,security_model=mapped-xattr,id=fs1 \
+      -virtfs local,path=$HOME,mount_tag=hosthome,security_model=mapped-xattr,id=fs2,readonly=on \
+      -nic user,hostfwd=tcp::2222-:22 -nographic
+
+# ssh into running sandbox
+sandbox-ssh:
+    ssh -A -p 2222 gorazd@localhost
+
+# hot-mount a host directory into the running sandbox
+sandbox-mount path:
+    ssh -p 2222 gorazd@localhost "mkdir -p ~/mnt/$(basename {{path}}) && sshfs matej@10.0.2.2:{{path}} ~/mnt/$(basename {{path}})"

modules/nixos/vm-guest.nix

@@ -0,0 +1,55 @@
+{
+  pkgs,
+  lib,
+  config,
+  ...
+}:
+{
+
+  options = {
+    vm-guest = {
+      enable = lib.mkEnableOption "VM guest configuration";
+    };
+  };
+
+  config = lib.mkIf config.vm-guest.enable {
+    services.qemuGuest.enable = true;
+    services.spice-vdagentd.enable = true;
+
+    # 9p for host file mounting
+    boot.initrd.availableKernelModules = [
+      "9p"
+      "9pnet_virtio"
+    ];
+    boot.kernelModules = [
+      "9p"
+      "9pnet_virtio"
+    ];
+
+    # ssh with agent forwarding for git and hot-mount
+    services.openssh = {
+      enable = true;
+      ports = [ 22 ];
+      settings = {
+        PasswordAuthentication = true;
+        PermitRootLogin = "no";
+        AllowAgentForwarding = true;
+        StreamLocalBindUnlink = "yes";
+      };
+    };
+
+    networking = {
+      useDHCP = true;
+      firewall.allowedTCPPorts = [ 22 ];
+    };
+
+    security.sudo.wheelNeedsPassword = false;
+
+    environment.systemPackages = with pkgs; [
+      curl
+      wget
+      htop
+      sshfs
+    ];
+  };
+}

packages/ahab.nix

@@ -1,7 +1,7 @@
 { pkgs, ... }:
 
 let
-  version = "v0.3.2";
+  version = "v0.4.1";
 in
 pkgs.rustPlatform.buildRustPackage {
   pname = "ahab";
@@ -12,10 +12,10 @@ pkgs.rustPlatform.buildRustPackage {
     owner = "janezicmatej";
     repo = "ahab";
     rev = version;
-    sha256 = "sha256-bL8LPpD5k97XPYftXhPr7V/LNOB71pcBlsfBjJUIeG8";
+    sha256 = "sha256-Y8UqZOskSlt8GrYem97yKXNbGkd6Ab7WRynKEA9w16E=";
   };
 
-  cargoHash = "sha256-f8omNtjLF5gMJGgxdzWifStcs8d4fu++EegR2auObXE";
+  cargoHash = "sha256-T5r+Og3+mHMsqCFGi+QzHdN2MgvPxzA/R+xu38I+lcg=";
 
   buildType = "debug";
 

packages/todo-mcp.nix

@@ -0,0 +1,39 @@
+{ pkgs, ... }:
+
+let
+  version = "v0.2.1";
+in
+pkgs.rustPlatform.buildRustPackage {
+  pname = "todo-mcp";
+  inherit version;
+
+  src = pkgs.fetchFromGitea {
+    domain = "git.janezic.dev";
+    owner = "janezicmatej";
+    repo = "todo-mcp";
+    rev = version;
+    sha256 = "sha256-BBL7PAgTdGR/+vEJmot8c8mgw5vq5Y/szud0YEiR1UY=";
+  };
+
+  cargoHash = "sha256-uAyD7Tj9qctDXQ5NkR6T/aItxRmd5WqIXr7NeOlCl8M=";
+
+  nativeBuildInputs = [ pkgs.installShellFiles ];
+
+  preBuild = ''
+    mkdir -p completions
+  '';
+
+  SHELL_COMPLETIONS_DIR = "completions";
+
+  postInstall = ''
+    installShellCompletion --bash completions/todo-mcp.bash
+    installShellCompletion --zsh completions/_todo-mcp
+    installShellCompletion --fish completions/todo-mcp.fish
+  '';
+
+  meta = {
+    description = "simple todo cli with mcp server for ai integration";
+    homepage = "https://git.janezic.dev/janezicmatej/todo-mcp";
+    maintainers = [ ];
+  };
+}

users/gorazd/home-manager.nix

@@ -17,6 +17,26 @@ in
     pkgs.git
   ];
 
+  # labwc desktop menu (right-click)
+  xdg.configFile."labwc/menu.xml".text = ''
+    <?xml version="1.0" encoding="UTF-8"?>
+    <openbox_menu>
+      <menu id="root-menu" label="">
+        <item label="Terminal"><action name="Execute"><command>foot</command></action></item>
+        <item label="Firefox"><action name="Execute"><command>firefox</command></action></item>
+        <item label="Files"><action name="Execute"><command>foot -e ranger</command></action></item>
+        <separator />
+        <item label="Reconfigure"><action name="Reconfigure" /></item>
+        <item label="Exit"><action name="Exit" /></item>
+      </menu>
+    </openbox_menu>
+  '';
+
+  # labwc autostart panel
+  xdg.configFile."labwc/autostart".text = ''
+    sfwbar &
+  '';
+
   programs.neovim = {
     enable = true;
     vimAlias = true;

users/matej/home-manager.nix

@@ -21,7 +21,8 @@ in
 
     pkgs.starship
 
-    pkgs.claude-code
+    inputs.claude-code-overlay.packages.${pkgs.stdenv.hostPlatform.system}.default
+    packages.todo-mcp
 
     # git and co
     pkgs.git