alyssa@work-dev: verify the profile works at all — agenix secrets, macOS paths on Linux, GUI closure

[alycda]

profiles/work.nix is instantiated twice: on darwin (the ditto machine) and as alyssa@work-dev on aarch64-linux. #81 fixed a container-only agenix bug but deliberately left this profile alone, because widening a darwin-shared module by inference is how you break the machine you can't test. Evaluating it turned up three things that want checking — and a question of whether the config is used at all.

1. agenix secrets silently never install (same bug as #81)

config.systemd.user.services → [ "agenix" ]
config.home.activation       → [ … ensureAgenixSecretsDirParent … ]   # no agenix

ragenix mounts secrets from a systemd user service. If work-dev is a container without a user systemd daemon — as dev is — every age.secrets entry silently never arrives. Nothing fails; the only symptom is a file that isn't there. Full write-up: docs/solutions/config-errors/agenix-secrets-never-install-without-systemd.md.

Fix is likely importing modules/agenix-activation.nix, but only once someone confirms this host genuinely lacks user systemd — importing it where ragenix's unit does run would give two installers racing.

2. macOS paths on a Linux configuration

home.homeDirectory  = /Users/alyssaevans
home.username       = alyssaevans
age.secretsDir      = /Users/alyssaevans/.local/share/agenix

work.nix sets these unconditionally, so the aarch64-linux instantiation builds a home under /Users/…. On Linux that path doesn't exist, which means the agenix fix above wouldn't help even if applied — it would decrypt into a directory nothing reads.

3. VS Code GUI closure in a headless configuration

config.programs.vscode.enable = true, package vscode-1.130.0. work.nix imports ../modules/ide/vscode.nix unconditionally, so the Linux instantiation pulls the full GUI closure — precisely what the comment in common.nix warns against ("pure dead weight that overflowed Docker's disk mid-build", #34).

Already correct — and the pattern to copy

agentSkills.liveCheckout resolves to null here, because work.nix gates it:

agentSkills.liveCheckout =
  lib.mkIf pkgs.stdenv.hostPlatform.isDarwin "${config.home.homeDirectory}/dotfiles";

The same isDarwin gate is the obvious template for items 2 and 3.

The prior question

Is alyssa@work-dev actually in use? If it's vestigial, deleting it from flake.nix closes all three at once and removes a configuration that nix flake check keeps evaluating. If it's live, it needs a real switch to confirm anything above, since every finding here is from evaluation only — I have not built or activated this configuration.

🤖 Generated with Claude Code