nixos-host-provisioning

name	nixos-host-provisioning
description	Adding or provisioning a NixOS host in a blueprint-based config flake — hosts/<name>/default.nix escape hatch wiring input modules (disko, sops-nix, nixos-hardware, nixos-facter), declarative partitioning with disko (GPT ESP+root, ext4 or btrfs subvolumes), hardware detection via nixos-facter instead of hardware-configuration.nix, and manual home-manager user wiring. Apply when adding a new machine to a NixOS flake; when writing or editing hosts/<name>/{default.nix,configuration.nix,disko.nix}; when generating or overriding facter.json; when a host needs modules from flake inputs; when home-manager users don't get created on a host. Do NOT use for non-NixOS projects, for nix-darwin-only hosts, or for flakes not using blueprint's hosts/ convention.
user-invocable	true
license	MIT
compatibility	Designed for Claude Code, Codex or similar harness, and for NixOS flakes using numtide/blueprint with disko/facter-style hosts.
metadata	{"author":"aldoborrero","version":"1.0.0","openclaw":{"emoji":"🖥","homepage":"https://github.com/aldoborrero/cc-skills-nix","requires":{"bins":"[Truncated]"},"install":[]}}
allowed-tools	Read Edit Write Glob Grep Bash(nix:*) Bash(git:*) Agent
paths	["**/hosts/**","**/disko.nix","**/facter.json"]

Adding a NixOS host (blueprint + disko + facter)

A host is a directory hosts/<name>/ with these entries (users/ only when the host has home-manager users; disko/facter only on bare metal). Reference implementations: the framework/sirius hosts in aldoborrero/nix-system. → Blueprint's host discovery rules and precedence: nix-blueprint skill.

hosts/<name>/
  default.nix         # escape hatch: nixosSystem call wiring input modules
  configuration.nix   # the host itself: imports shared modules + hardware quirks
  disko.nix           # declarative partitioning
  facter.json         # hardware report (replaces hardware-configuration.nix)
  users/<user>.nix    # home-manager config for the user on this host

default.nix — the escape hatch, and what it costs

Needed whenever the host imports modules from flake inputs (disko, facter, nixos-hardware, sops-nix have nowhere else to be imported):

{ flake, inputs, hostName }:
{
  class = "nixos";
  value = inputs.nixpkgs.lib.nixosSystem {
    modules =
      (with inputs; [
        disko.nixosModules.disko
        nixos-facter-modules.nixosModules.facter
        nixos-hardware.nixosModules.framework-12th-gen-intel
        sops-nix.nixosModules.sops
      ])
      ++ [ ./configuration.nix ./disko.nix ];
    specialArgs = { inherit flake inputs hostName; };
  };
}

Cost: hand-rolling nixosSystem means blueprint's automation for this host is off — you provide specialArgs yourself (as above), and home-manager users are NOT auto-wired. Re-add them manually in configuration.nix:

home-manager.users.<user> = import ./users/<user>.nix { inherit flake; };

with the home-manager bridge (a shared module importing inputs.home-manager.nixosModules.default, setting useGlobalPkgs/useUserPackages/backupFileExtension, extraSpecialArgs = { inherit inputs flake; ... } and third-party sharedModules) in the host's import list. perSystem is also not injected on this path. The standalone homeConfigurations."<user>@<host>" output still appears — blueprint derives it from users/ regardless of host type.

configuration.nix — thin: imports + hardware quirks only

{ flake, hostName, lib, modulesPath, ... }:
with lib;
{
  imports = [ "${modulesPath}/installer/scan/not-detected.nix" ]
    ++ (with flake.modules.nixos; [ core networking nix sops /* one topic per module */ ]);

  boot.loader.systemd-boot.enable = true;
  boot.loader.efi.canTouchEfiVariables = true;

  facter.reportPath = ./facter.json;
  facter.detected.dhcp.enable = lib.mkForce false;   # override wrong detections case by case

  networking.hostName = hostName;
  nixpkgs.hostPlatform = mkDefault "x86_64-linux";
  system.stateVersion = "<release>";   # the NixOS release current at FIRST install — then never change it
}