sm

configurations/default.nix

@@ -9,10 +9,4 @@
     sapphira = import ./server.nix flakeContext; # sapphira
     wsl = import ./wsl.nix flakeContext; # wsl
   };
-  nixOnDroidConfigurations = {
-    epral = import ./mobile.nix flakeContext; # epral (Android via nix-on-droid)
-    # Alias so a plain `nix-on-droid switch` from a local clone
-    # (~/.config/nix-on-droid) picks up the device config without `#epral`.
-    default = import ./mobile.nix flakeContext;
-  };
 }

droid/default.nix

@@ -0,0 +1,9 @@
+{ inputs, ... }@flakeContext:
+{
+  nixOnDroidConfigurations = {
+    epral = import ./epral.nix flakeContext; # epral (Android via nix-on-droid)
+    # Alias so a plain `nix-on-droid switch` from a local clone
+    # (~/.config/nix-on-droid) picks up the device config without `#epral`.
+    default = import ./epral.nix flakeContext;
+  };
+}

droid/epral.nix

@@ -18,7 +18,7 @@ let
     }:
     {
       imports = [
-        inputs.self.nixosModules.strict
+        inputs.self.nixosModules.default # base defaultModule (termux-trimmed)
       ];
 
       xlib.device = {
@@ -31,11 +31,6 @@ let
       # (default is bashInteractive)
       user.shell = "${pkgs.zsh}/bin/zsh";
 
-      # SSH user (matches `User oqyude` in the client's ~/.ssh/config).
-      # Default is "nix-on-droid"; home stays at the read-only
-      # /data/data/com.termux.nix/files/home either way.
-      user.userName = "oqyude";
-
       # Minimal termux settings (nix-on-droid options only:
       # environment.*, nix.*, time.*, user.*, system.*, android-integration.*)
 
@@ -49,26 +44,26 @@ let
         nano
 
         # Some common stuff that people expect to have
-        bzip2
+        openssh
+        treefmt
+        git
+        procps
+        psmisc # provides killall (attr `killall` was removed from nixpkgs)
         diffutils
         findutils
-        git
+        util-linux # renamed from utillinux
+        tzdata
+        hostname
+        man
         gnugrep
         gnupg
         gnused
         gnutar
+        bzip2
         gzip
-        hostname
-        man
-        ncurses
-        openssh
-        procps
-        psmisc # provides killall (attr `killall` was removed from nixpkgs)
-        treefmt
-        tzdata
-        unzip
-        util-linux # renamed from utillinux
         zip
+        unzip
+        ncurses
       ];
 
       # Backup etc files instead of failing to activate generation if a file already exists in /etc
@@ -77,17 +72,12 @@ let
       # Shared userspace home-manager config (same cozy shell as on NixOS hosts).
       # nix-on-droid forces home.username / home.homeDirectory from user.*,
       # so the strict module must not set them.
-      # xlib is injected via home-manager.extraSpecialArgs (the HM submodule
-      # does not inherit the nix-on-droid module args).
       home-manager = {
         useGlobalPkgs = true;
         backupFileExtension = "hm-bak";
-        extraSpecialArgs = {
-          inherit xlib;
-        };
         config = { ... }: {
           imports = [
-            ../home/termux.nix
+            ../home/shared/strict.nix
           ];
           home.stateVersion = "24.05";
         };

flake.nix

@@ -120,6 +120,7 @@
     }
     // (import ./configurations flakeContext)
     // (import ./deploy flakeContext)
+    // (import ./droid flakeContext)
     // (import ./home flakeContext)
     // (import ./modules flakeContext)
     // (import ./overlays flakeContext)

home/shared/strict.nix

@@ -2,7 +2,6 @@
   config,
   lib,
   pkgs,
-  xlib,
   ...
 }:
 # Shared "strict" home-manager module.
@@ -18,8 +17,7 @@
 # (which stay NixOS-only for now). When this module is wired into NixOS hosts
 # via sharedModules, deduplicate those files.
 {
-  home = {
+  home.packages = with pkgs; [
-    packages = with pkgs; [
     # Lazy (alias lc)
     lazycli
 
@@ -47,23 +45,18 @@
     # Monitoring
     htop
   ];
-    sessionVariables = {
+
+  home.sessionVariables = {
     TUCKR_HOME = "$HOME/Storage/dotfiles";
     EDITOR = "fresh";
   };
-    file = {
+
-      ".nanorc".text = ''
+  home.file.".nanorc".text = ''
     set nowrap
     set tabstospaces
     set tabsize 2
   '';
-      # Authorized keys for sshd (see modules/termux/default.nix).
+
-      # Declarative for now — the Store/.ssh symlink scheme is postponed.
-      ".ssh/authorized_keys".text = ''
-        ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKduJia+unaQQdN6X5syaHvnpIutO+yZwvfiCP4qKQ/P
-      '';
-    };
-  };
   programs = {
     # ---- Shell: zsh ----
     zsh = {
@@ -75,12 +68,7 @@
         enable = true;
         theme = "robbyrussell";
       };
-      loginExtra = "clear && fastfetch && cd ~/.config/nix-on-droid";
+      loginExtra = "clear && fastfetch";
-      # .zshenv — sourced by zsh in ALL sessions incl. non-login ssh commands.
-      # runit from nixpkgs defaults to /var/service as SVDIR, but our tree
-      # lives at ~/service (symlinked as /etc/service). Export it so that
-      # `sv status sshd` works without qualifying the path.
-      envExtra = "export SVDIR=/etc/service";
       initContent = ''
         beet-p() {
           local base="${config.home.homeDirectory}/.config/beets/My"
@@ -102,7 +90,6 @@
         lg = "lazygit";
         lc = "lazycli";
         gp = "git pull";
-        ns = "nix-on-droid switch --flake ~/.config/nix-on-droid#${xlib.device.hostname}";
         gp-ns = "gp && ns";
         gc = "git add . && git commit -m 'dev: автокоммит $(date +'%Y-%m-%d %H:%M:%S')'";
         y = "yazi";
@@ -110,8 +97,6 @@
         beet-path-library = "realpath --relative-to='${config.home.homeDirectory}/.config/beets/My' .";
         z-proxy = "export ALL_PROXY=socks5://localhost:10808";
         zh-proxy = "export HTTPS_PROXY=http://localhost:10808 && export HTTP_PROXY=http://localhost:10808";
-        nix-dir = "cd ~/.config/nix-on-droid";
-        q-ssh = "sv-start"; # start all supervised services (sshd, ...); manage with `sv status sshd` etc
 
         # beets
         beet-ima = "beet im ./ -A";
@@ -131,6 +116,7 @@
         pip2nix = "nix run github:nix-community/pip2nix --"; # https://github.com/nix-community/pip2nix
         pip2nix-g = "nix run github:nix-community/pip2nix -- generate -r";
         json2nix = "nix run github:sempruijs/json2nix";
+        reb = "nix-on-droid switch --flake ~/.config/nix-on-droid";
       };
     };
 

modules/default.nix

@@ -12,11 +12,15 @@ let
       # NixOS-only modules. termux runs nix-on-droid (its own module system,
       # class = "nixOnDroid"): options like services.*, users.*, sops.*, disko.*
       # and nixpkgs.overlays (flake assertion) do not exist there.
-      imports = with inputs; [
+      imports =
-        ./essentials
+        with inputs;
+        [
           ./options.nix
+          (./. + "/${deviceType}") # specific modules
+        ]
+        ++ lib.optionals (deviceType != "termux") [
+          ./essentials
           ./users.nix
-        (./. + "/${deviceType}")
 
           home-manager.nixosModules.home-manager # home-manager module
           # nix-index-database.nixosModules.nix-index # nix-index module
@@ -25,9 +29,12 @@ let
           self.homeConfigurations.default.nixosModule # default homeConfigurations
           disko.nixosModules.disko # disko module
         ];
-      nixpkgs.overlays = with inputs; [
+      # nix-on-droid asserts that nixpkgs.* stays unset in flake mode.
+      nixpkgs.overlays = lib.mkIf (deviceType != "termux") (
+        with inputs; [
           self.nixosOverlays.default
-      ];
+        ]
+      );
       _module.args = {
         inputs = inputs;
         xlib = config.xlib;
@@ -50,28 +57,6 @@ let
         sops-nix.nixosModules.sops # sops module
       ];
 
-      _module.args = {
-        inputs = inputs;
-        xlib = config.xlib;
-      };
-    };
-  strictModule =
-    {
-      config,
-      deviceType,
-      lib,
-      xlib,
-      ...
-    }:
-    {
-      imports = with inputs; [
-        # ./essentials
-        # ./users.nix
-        ./options.nix
-        (./. + "/${deviceType}")
-        # sops-nix.nixosModules.sops
-      ];
-
       _module.args = {
         inputs = inputs;
         xlib = config.xlib;
@@ -82,6 +67,5 @@ in
   nixosModules = {
     default = defaultModule;
     public = publicModule;
-    strict = strictModule;
   };
 }

modules/termux/default.nix

@@ -1,90 +1,9 @@
 {
-  config,
   lib,
   pkgs,
   ...
 }:
-let
-  sshdDir = "${config.user.home}/sshd";
-  sshdTmpDir = "${config.user.home}/sshd-tmp";
-  port = 8022;
-  serviceDir = "${config.user.home}/service";
-
-  # runit run-scripts (executable store paths, linked into ~/service).
-  sshdRun = pkgs.writeScriptBin "sshd-run" ''
-    #!${pkgs.runtimeShell}
-    exec ${pkgs.openssh}/bin/sshd -f /etc/ssh/sshd_config -D
-  '';
-  svLogRun = pkgs.writeScriptBin "sv-log-run" ''
-    #!${pkgs.runtimeShell}
-    mkdir -p ./main
-    exec ${pkgs.runit}/bin/svlogd -tt ./main
-  '';
-  svStart = pkgs.writeScriptBin "sv-start" ''
-    #!${pkgs.runtimeShell}
-    exec ${pkgs.runit}/bin/runsvdir ${serviceDir}
-  '';
-in
 {
-  # Minimal sshd server for LAN access (e.g. `ssh epral` from other hosts).
+  # imports = [
-  # nix-on-droid has no systemd: sshd is started manually via `sshd-start`
+  # ];
-  # (or from Termux:Boot / a session). The host key is generated once on the
-  # first activation and kept in ~/sshd (NOT /etc — it is rebuilt on every
-  # activation).
-  environment.etc."ssh/sshd_config".text = ''
-    HostKey ${sshdDir}/ssh_host_ed25519_key
-    Port ${toString port}
-    PasswordAuthentication no
-    AllowUsers ${config.user.userName}
-  '';
-
-  # Generate the host key on first activation (idempotent).
-  build.activation.sshd = ''
-    if [[ ! -d "${sshdDir}" ]]; then
-      $DRY_RUN_CMD rm -rf "${sshdTmpDir}"
-      $DRY_RUN_CMD mkdir -p "${sshdTmpDir}"
-      $VERBOSE_ECHO "Generating sshd host key..."
-      $DRY_RUN_CMD ${pkgs.openssh}/bin/ssh-keygen -t ed25519 -f "${sshdTmpDir}/ssh_host_ed25519_key" -N ""
-      $DRY_RUN_CMD mv "${sshdTmpDir}" "${sshdDir}"
-    fi
-  '';
-
-  # nix-on-droid's session-init adds ~/.nix-defexpr/channels to NIX_PATH
-  # unconditionally; nix warns about the missing dir on every invocation.
-  # Making it exist silences the warning. Must be done in activation (not
-  # home-manager): ~/.nix-defexpr/channels is a symlink into
-  # ~/.local/state/nix/profiles/channels (dangling until it exists), which
-  # home-manager cannot link into. mkdir -p refuses to traverse a dangling
-  # symlink, so create the real target dir instead.
-  build.activation.nixdefexpr = ''
-    $DRY_RUN_CMD mkdir -p "${config.user.home}/.local/state/nix/profiles/channels/nixpkgs"
-    $DRY_RUN_CMD touch "${config.user.home}/.local/state/nix/profiles/channels/nixpkgs/.keep"
-  '';
-
-  # runit service tree: ~/service/<name>/{run,log/run}. run/ and log/run are
-  # symlinks into the nix store (read-only is fine; runsvdir writes only to
-  # the <name>/supervise dirs). /etc/service is symlinked for `sv status`.
-  # NOTE: tailscaled was removed — nixpkgs' linux build cannot run inside
-  # proot (SELinux blocks netlink; needs GOOS=android or root). Re-add only
-  # if that gets solved.
-  build.activation.services = ''
-    $DRY_RUN_CMD rm -rf ${serviceDir}/tailscaled
-    $DRY_RUN_CMD mkdir -p ${serviceDir}/sshd/log
-    $DRY_RUN_CMD ln -sfn ${sshdRun}/bin/sshd-run ${serviceDir}/sshd/run
-    $DRY_RUN_CMD ln -sfn ${svLogRun}/bin/sv-log-run ${serviceDir}/sshd/log/run
-    $DRY_RUN_CMD ln -sfn ${serviceDir} /etc/service
-  '';
-
-  environment.packages = [
-    pkgs.runit
-
-    # one command brings up all supervised services (sshd, ...)
-    svStart
-
-    # manual fallback for sshd only
-    (pkgs.writeScriptBin "sshd-start" ''
-      #!${pkgs.runtimeShell}
-      exec ${pkgs.openssh}/bin/sshd -f /etc/ssh/sshd_config -D "$@"
-    '')
-  ];
 }